Add Access Rule
checkpoint_add_access_ruleAdd a draft access rule to the current management session for operator review before committing and installing the policy.
Instructions
Add a new access rule to the current session.
The rule is created with status draft and is NOT committed or
installed -- it lives in the current management session only. The
orchestrator surfaces the draft to the operator for review, then
calls checkpoint_publish_session and checkpoint_install_policy
to move it through the lifecycle.
This is typically a human-gated step in a change workflow, reserved for network-policy changes.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Human-readable rule name (e.g. "Compensating control: hmi-pack-01 SMB"). | |
| layer | No | Access layer name. Defaults to the configured default layer. | |
| action | No | Action verb: one of Drop, Accept, Reject, Inform. Compensating-control default is 'Drop'. | Drop |
| source | Yes | Source object name(s). Use `Any` for unrestricted source. For compensating controls the typical value is `Any`. | |
| service | Yes | Service object name(s) (e.g. "smb", "tcp/445"). | |
| comments | Yes | Free-text justification stored on the rule. Reference the unpatchable CVE / CI and the iTop change ref so a future reviewer understands why the rule exists. | |
| destination | Yes | Destination object name(s). For compensating controls this is the unpatchable CI alias (e.g. "hmi-pack-01"). MUST be alias-scrubbed. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |