> For the complete documentation index, see [llms.txt](https://docs.bird.com/api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bird.com/api/api-access/access-policies.md).

# Access Policies

An access policy is a set of rules that determines access to one or more API resources. Policies are the building blocks of [access roles](/api/api-access/access-roles.md) and define the fine-grained operations a role can perform.

Policies are managed at **Workspace > Team > Roles & Policies > Policies**.

{% hint style="info" %}
Access keys use a simplified permission model and do not require custom policies. See [API Authorization](/api/api-access/api-authorization.md) for details on creating access keys.
{% endhint %}

## Managed policies

Bird provides **managed policies** for common operations, organized by application area (General, Developer, Marketing, Support, Email, AI Hub, CRM, and more). Each managed policy includes a description, the number of operations it covers, and whether it has resource filters.

## Understanding policy rules

Policy rules provide fine-grained control over API access. By default, any endpoint not explicitly allowed is denied.

| Field       | Description                                  | Values                                    |
| ----------- | -------------------------------------------- | ----------------------------------------- |
| Effect      | Allow or deny access to the listed resources | Allow, Deny                               |
| Action      | The HTTP method(s) the rule permits          | Any, Create (POST), View (GET)            |
| Resource(s) | API path(s) the rule applies to              | e.g. `/workspaces/{workspaceID}/channels` |

### Resource path wildcards

Use wildcards to match multiple paths:

* `*` matches any value for a single path segment, e.g. `/workspaces/*/channels` applies to all workspaces
* `**` matches all child paths, e.g. `/workspaces/*/channels/**` grants access to all paths below `/channels`