# Policy

## Summary

The `policy` block inside a `route` definition defines the authorization policy applied to a route. Policies are defined using Pomerium Policy Language (**PPL**), a yaml-based markup designed to be easier to read and implement compared to current alternatives.

See [Pomerium Policy Language](https://www.pomerium.com/docs/internals/ppl.md) for a full explanation of how to write policies in PPL.

## How to configure

**Core:**

| **YAML**/**JSON** setting | **Type**                  | **Usage**    |
| :------------------------ | :------------------------ | :----------- |
| `policy`                  | `object` (PPL rule block) | **optional** |

### Examples

```yaml
routes:
  - from: https://verify.localhost.pomerium.io
    to: http://verify:8000
    policy:
      - allow:
          and:
            - domain:
                is: pomerium.com
            - user:
                is: user
```

**Enterprise:**

**Kubernetes:**

| **[Annotation name](https://www.pomerium.com/docs/deploy/k8s/ingress.md#set-authorization-policy)** | **Type** | **Usage** |
| :-- | :-- | :-- |
| `policy` | `object` (PPL rule block) | **optional** |

### Examples

```yaml
ingress.pomerium.io/policy: |
  allow:
    and:
      - domain:
          is: pomerium.com
      - user:
          is: user
```