Developers · Users and Permissions

Adding an Authorization Policy

Last updated 7 November 2026

This article shows you how to add an Authorization Policy.

Important

The actions outlined in this document can be performed using the Instance Admin. For more details, please refer to the documentation on Authorization Policies.

Prerequisites

To understand this tutorial, it is necessary to have a good understanding of the mandatory directory structure for your codebase and comprehension of Permissions. You will also use the GraphQL query created in a previous tutorial.

Steps

Adding an Authorization Policy is a two-step process:

Step 1: Create an Authorization Policy file
Step 2: Edit the Authorization Policy file

Step 1: Create an Authorization Policy file

To add an Authorization Policy, create a file in the directory, for example, .

Step 2: Edit the Authorization Policy file

You can use all the Liquid and GraphQL features in your Authorization Policy.

Assuming you have prepared the GraphQL query , an example of a policy file can look like this:

---
name: only_allowed_by_johns
---
{% graphql g = "current_user" %}
{% if g.current_user.first_name == "John" %}true{% else %}false{% endif %}

In this example, only users with the first name will be allowed to perform the action with this policy.

Next Steps

Congratulations! You know how to add an Authorization Policy. Now you can learn about associating the Authorization Policy with a Form: Associating an Authorization Policy with a Form