Time-Based Policies Documentation: (time field, Timestamp, CronSpan) - #752
Open
omkarshanbhag wants to merge 5 commits into
Open
Time-Based Policies Documentation: (time field, Timestamp, CronSpan)#752omkarshanbhag wants to merge 5 commits into
time field, Timestamp, CronSpan)#752omkarshanbhag wants to merge 5 commits into
Conversation
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
omkarshanbhag
force-pushed
the
omkar/time-based-policies
branch
from
August 4, 2026 19:56
8e24f2b to
e8fe605
Compare
omkarshanbhag
changed the title
time field, Timestamp, CronSpan)
Contributor
There was a problem hiding this comment.
Pull request overview
Adds documentation for the new top-level policy time field and its related language constructs so authors can gate policy evaluation by trusted server time, including one-shot timestamp windows and recurring cron-based spans.
Changes:
- Added a new “Time-based policies” authoring guide covering
time.now,Timestamp(...), andCronSpan(...)with examples. - Extended the policy language reference with
timestamp,time.now, and function signatures forTimestamp/CronSpan. - Added a new time-based section to the access-control examples and linked the new page into the docs sidebar.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| features/policies/time-based-policies.mdx | New authoring guide for the time policy field with one-shot and recurring window examples. |
| features/policies/language.mdx | Adds time keywords/types/functions to the policy language reference and links to time docs. |
| features/policies/examples/access-control.mdx | Adds practical time-based policy examples to the access-control examples page. |
| docs.json | Registers the new time-based policies page in the documentation sidebar/navigation. |
Suppressed comments (1)
features/policies/language.mdx:86
- The
timestamptype row points readers to theTimekeyword section, but the UTC-onlyTimestamp(...)construction details live under the time function reference. After adding## Time expressions, link there to avoid sending readers to an unrelated section.
| **timestamp** | Timestamp('2025-01-01T00:00:00Z') | a point in time; construct with `Timestamp('<rfc3339>')`, UTC only (see [Time](#time)) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
grahamritter
reviewed
Aug 5, 2026
andrewkmin
reviewed
Aug 5, 2026
andrewkmin
left a comment
andrewkmin
left a comment
Contributor
There was a problem hiding this comment.
Verified these points against tkhq/mono release v2026.8.0 and reproduced the boundary behavior with the real TimeEvaluator.
andrewkmin
reviewed
Aug 6, 2026
| `condition`, it is written in the policy language and must evaluate to a `bool`. When `time` is not | ||
| specified, the policy is always active. When the current time falls within the defined window, the | ||
| expression evaluates to `true` and the policy participates in evaluation as usual. When it falls | ||
| outside the window, the expression evaluates to `false` and the policy is skipped for that request. |
Contributor
There was a problem hiding this comment.
do we want to include the symptom of this? ie ..._INACTIVE?
Contributor
Author
There was a problem hiding this comment.
will include in follow up
andrewkmin
reviewed
Aug 6, 2026
|
|
||
| #### Grant a user temporary access for a fixed window (one-shot) | ||
|
|
||
| This policy allows the user to sign transactions only during January 2025 (UTC). The window is |
Contributor
There was a problem hiding this comment.
tiny nit: can use a more recent timestamp
andrewkmin
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR contains documentation for time based policies (introduced via a new top level field on policies called
time)Overall Summary of new functionality added:
### Timekeyword subsection documentingtime.now(typetimestamp, single trusted server-time value per request).timestampprimitive type row (Timestamp('<rfc3339>'), UTC-only).## Timesection covering:timemust eval tobool; evaluated against trusted server time; absent/empty = always active,false= policy skipped (not a deny).time.nowandTimestamp('<rfc3339>')(UTC only —Z; non-zero offsets rejected).time.now >= Timestamp(start) && time.now < Timestamp(end)(start-incl, end-excl).CronSpan('<cron>', '<duration>', '<tz>')— fire + duration union model, strict 5-field cron subset (no*/n,@macros, names, seconds), Go-styled/h/mduration ≤ 7 days, IANA tz / DST-aware.CronSpan('0 9 * * 1-5', '8h', 'America/New_York'), with a callout warning against the hour-range (0 9-17 ...) form.&&/||/!), and combiningtimewithconsensus+condition.🤖 Generated with Claude Code