Getting Started
What is Node9?Quick StartHow It WorksForecastAgent IntegrationsAccount & Machine
Configuration
ConfigurationPrivacy & Cloud ModeSmart RulesEffective ConfigurationPersistent DecisionsPause & Resume
Protections
ShieldsSandboxSecurity PostureContent Scanner (DLP)Trusted HostsCanary CredentialsSkill PinningRepository ScanningEgress ControlBadges
Integrations
MCP GatewayMCP ServerPython SDKGoverned Agents
Operations
Mission ControlReportSecurityAgentic Threat CoverageBlast RadiusSessions & Live ActivityRedacting Session HistoryCloud Policy Rules
Help
Help & SupportAbout Node9

Cloud Policy Rules · node9 documentation

Cloud Policy Rules

The rules a workspace publishes, the copy this machine is holding, and how to tell them apart.

What this machine holds
node9 policy show
node9 policy status
show lists the cached rules. status is the more useful one: how many rules are cached, when the cache was last filled, and which workspace it belongs to.
Pull and push
node9 policy sync
node9 policy push
sync pulls the workspace's rules into the local cache. push sends this machine's effective policy up, which is how a workspace is seeded from a machine that is already configured the way you want.
Check the timestamp before you trust the rules
node9 policy status
The line that matters is when the cache was last filled. A machine that has not synced recently is enforcing an older picture of the workspace, and nothing about its behaviour will look wrong. If a rule you published is not taking effect, read this before reading the rule.

Rules are one layer. The rest of what a workspace governs, such as which shields apply and which paths are jailed, arrives separately and is visible through node9 config show and node9 shield list.