Skip to content
chant Docs Demo

Getting Started

llms.txt lists every page for an agent
Optional: hand this page to your coding agentThe steps work by hand too.
Show the whole prompt
Read https://intentius.io/chant/lexicons/cedar/getting-started/.
In a new directory, run `npx chant init --lexicon cedar --template default my-authz` and `npm install` in it, then `npx chant cedar generate` and `npx chant build`.
Run `npx chant cedar coverage` and show me the output and the three artifacts in `dist/`.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Three steps, in this order. The second one is the one people skip.

1. Scaffold

Section titled “1. Scaffold”
Terminal window
npx chant init --lexicon cedar --template default my-authz
cd my-authz && npm install

Three templates ship: default (a permit/forbid pair), avp-embedding (a multi-tenant store bound for Verified Permissions), and gateway-policy-set (API routes as entities, behind a deny floor). Each writes a schema.cedarschema at the project root and a src/policies.ts typed against it.

2. Generate

Section titled “2. Generate”
Terminal window
npx chant cedar generate

This step is required. The classes and action constants policies.ts imports do not exist until generate has read your schema. Re-run it whenever the schema changes.

The output lands in your project, at src/generated/cedar/ by default, and src/policies.ts imports from there:

import { Policy, ReadAction, WriteAction } from "./generated/cedar";

It is your artifact, not the package’s. It never goes under node_modules, so it survives npm ci; commit it, or run chant cedar generate in CI before chant build. cedar.outDir in chant.config.ts moves it (see Schema).

What it produces, per declaration:

SchemaGenerated
entity Document in [Folder] = { … }Document, DocumentAttributes, DocumentUid
action read appliesTo { … }ReadAction, ReadContext
—Policy, EntityTypeName, ActionUid, PolicyScope, ALL_ACTIONS, ALL_ENTITY_TYPES

@intentius/chant-lexicon-cedar itself also exports a Policy and the classes for the schema it bundles. Those describe the package’s sample entity model, not yours, which is why the scaffold imports from ./generated/cedar.

3. Build

Section titled “3. Build”
Terminal window
npx chant build

Three artifacts land in dist/: the .cedar text, policies.cedar.json, and your schema.cedarschema. The schema is emitted beside the policies so every policy set is validated against it by cedar-wasm, the Cedar validator, running in this process with no CLI or Docker. A project with no schema of its own gets a parse-only check and CEDE010 says so.

Then

Section titled “Then”
Terminal window
npx chant cedar coverage   # is every schema declaration generated?

The MCP tool cedar:coverage reports which schema declarations the policy set actually reaches. See Lint Rules.

The example projects

Section titled “The example projects”

Two ship with the lexicon:

  • examples/getting-started — one permit, one forbid, against the bundled default schema.
  • examples/basic-policies — a project-local schema.cedarschema and a four-policy set.

Both are exercised in CI: the emitted .cedar text is handed straight to cedar-wasm, so a policy set chant is happy with but Cedar rejects fails the build rather than the deploy.

chant