> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a policy

> Create a Ranger policy from the NexusOne portal.

Create a Ranger policy yourself when you want full control over its resources, principals, and settings. NexusOne writes
the policy directly to Ranger when you submit it.

## Prerequisites

Before starting this task, ensure you have the following:

Required roles: `nx1_migration_admin` or `nx1_migration_ops`.

## Create a policy

Perform these steps to create a policy.

1. Log in to NexusOne.

2. On the top navigation bar, hover your mouse over **Govern** and then select **Data Access**.

3. Click the **All policies** tab.

4. Click **New Policy**.

5. Describe the policy:

   * **Policy name**: Optional. Enter a name. If you leave it empty, NexusOne names the policy from its resources.
   * **Policy type**: Select **Access**, **Masking**, or **Row Filter**.
   * **Description**: Optional. Enter who or what the policy governs, and why.

6. In the **Resources** section, add each resource the policy covers:

   1. Select a resource in the **Resource** list.
   2. Enter one or more values, separated by commas.
   3. Optional: Select **Excludes** to apply the policy to everything except those values, or **Recursive** to include
      everything under them. A resource shows these options only when Ranger supports them.
   4. Click **Add**.

   A resource needs all of its parents. For example, a `table` needs its `catalog` and `schema`.

7. Set who the policy applies to. The section depends on the policy type:

   * **Access**: In the **Allow** section, do the following:

     1. In the **Access types** field, select the access types.
     2. In the **Groups** and **Users** fields, select who gets the access.
     3. Optional: Select **Delegate admin** to let them grant the access to others.
     4. Optional: Click **Add allow item** to add another row.
     5. Optional: To deny access or add exceptions, expand **Deny items**, **Allow exceptions**, or **Deny exceptions**.

   * **Masking**: In the **Masking** section, select the **Mask type**, and then select the access types, groups, and users.
     For a **Custom** mask type, enter the **Custom mask expression**. Optionally, enter a **Mask condition** so the mask
     applies only when the condition is true. Click **Add mask rule** to add another rule.

   * **Row Filter**: In the **Row filters** section, enter a **Filter expression**, and then select the access types,
     groups, and users. The expression is a SQL `WHERE` fragment, for example `region = 'EU'`. Click **Add filter rule**
     to add another rule.

8. Optional: In the **Options** section, set the following:

   * **Enabled**: When off, Ranger ignores the policy.
   * **Audit logging**: Writes an audit record every time Ranger evaluates the policy.
   * **Deny all else**: Denies anything the policy doesn't explicitly allow.
   * **Priority**: Select **Normal** or **Override**.
   * **Labels**: Enter a label and press Enter to add it.

9. Click **Create policy**.

## Additional resources

For an overview of the Govern feature, refer to [Govern Overview](https://docs.nx1cloud.com/documentation/govern/overview.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.