Write a Policy in Magistrate
The Magistrate studio writes the policy for you. You say what you are trying to solve, review what it wrote, and sign it off. You don't need to write OPL yourself.
1. Start from a template or describe the rule
Open magistrate.octetproof.com and pick a starting point:
| Template | What it starts with |
|---|---|
| Country access | One or more countries to include or exclude |
| US state access | The United States, with states to include or exclude |
| OFAC embargo | Cuba, Iran, North Korea, Crimea, Sevastopol, Donetsk and Luhansk |
| EU sectoral sanctions | Iran, North Korea, Russia, Belarus, Crimea, Sevastopol, Donetsk, Luhansk, Kherson and Zaporizhzhia |
| UK sectoral sanctions | The same places as the EU list |
| OFAC + EU + UK | All three lists together |
Each sanctions list shows the month it was last reviewed. Russia and Belarus are covered as whole countries, and the Ukrainian regions as whole regions, which goes further than the sanctions require. Check each list against your own obligations before you sign it off.
Or describe the rule in the chat, in your own words, for example "Only users in Germany, Austria and Switzerland" or "Everyone in the US except New Jersey". You can type or dictate. Keep refining in the chat until the policy says what you mean.
Today the studio writes policies about countries and US states, and the named sanctions lists above. Each place is either included or excluded.
2. Review the policy
The studio shows the policy three ways:
- As sentences. Each rule in plain English, for example "The device is in Austria".
- As a map. The places the policy includes and excludes, with the question and its answers.
- As OPL. The exact policy text the engine will decide, in the code pane. See OPL Overview to read it.
Approve each sentence. If one is wrong, go back to the chat and change it.
3. Read the question
Every policy asks one question about where the device is, for example:
- "Is the device in Iran?"
- "Is the device in the United States, outside Puerto Rico?"
Octet answers it for every request with YES, NO or UNKNOWN. Decide now what your backend does with each answer. UNKNOWN means the proofs couldn't settle the question, for example because the device has no current location fix. The engine answers it with deny.
4. Sign and send
Sign and send needs every sentence approved, your name, and your confirmation that you have the authority to ship the policy. It then publishes the policy:
- The engine checks the policy. A policy it can't decide is refused.
- The engine compiles the policy and signs it as a policy bundle.
- Apps with the Magistrate module pick up the signed policy the next time they fetch it.
Each publish is a new version, and the engine always decides with the newest one. A device that still holds the older version may make proofs the new version can't use. It then gets UNKNOWN until it fetches the new version.
5. Ship
The Ship page gives you what your developers need:
- the policy's question and its three answers
- a code snippet for the Magistrate module
- the policy as a
.oplfile - a link to get the Octet Mobile SDK, if you don't have it yet
6. Connect the policy to your license
Your Octet contact connects the published policy to your Octet license. Get the SDK through the Ship page's link, so Octet can find your policy. Until the policy is connected, the Magistrate module throws notProvisioned.