# chainctl policy custom update

URL: https://chainguard-docs-preview-git-athena-mention.chainguard.app/platform/chainctl/chainctl-docs/chainctl_policy_custom_update.md
Last Modified: October 12, 2026
Tags: chainctl, Reference, Product

## chainctl policy custom update

Update a custom policy.

### Synopsis

Update a custom policy in one of two modes:

  --file: full replacement from a YAML manifest. The manifest supplants
  the entire policy definition. The resulting policy is exactly what
  the manifest declares (name, description, expression,
  supported_resource_type, and parameters).

  Flag mode: partial update via individual flags. Only the fields you
  pass are changed; everything else is preserved. Flag mode is
  restricted to policies that do NOT declare parameter schemas. For
  parameterized policies, use --file.

The supported resource type is immutable. A --file update whose
manifest declares a different resource type than the current policy is
rejected. Update addresses one policy, so a manifest using the repeated
`supported_resource_types` to name several — the form
`create` fans out — is rejected here; update each resource type
in turn instead.

If the target policy's name is not unique within the organization
(more than 1 policy can share a name when their resource types
differ), pass --resource-type to disambiguate. Ignored when --policy
is given by UIDP.

See `chainctl policy custom create --help` for the manifest fields and the
required Rego package and `allow` rule.

```
chainctl policy custom update --policy NAME_OR_ID --file POLICY.yaml | [--name NAME] [--description DESC] [--expression FILE.rego] [--parent ORGANIZATION_NAME | ORGANIZATION_ID] [--output=json|table] [flags]
```

### Examples

```

# Full replacement from a manifest
chainctl policy custom update --policy cooldown-30 --file policy.yaml --parent example.com

# Rename only
chainctl policy custom update --policy cooldown-30 --name cooldown-strict --parent example.com

# Change just the description
chainctl policy custom update --policy cooldown-30 --description "block pulls from images newer than 30 days"

# Replace the expression from a new .rego (parameterless policies only)
chainctl policy custom update --policy cooldown-30 --expression new-cooldown.rego

# Disambiguate a policy name shared across resource types
chainctl policy custom update --policy cooldown-30 --resource-type Python --description "python-only variant"

```

### Options

```
      --description string     New description. Flag mode only; mutually exclusive with --file.
  -e, --expression string      Path to a new Rego expression (.rego) file. Flag mode only; mutually exclusive with --file.
  -f, --file string            Path to a policy manifest YAML file. Full replacement — supplants the entire policy definition.
      --name string            New policy name. Flag mode only; mutually exclusive with --file.
      --parent string          The name or id of the organization the policy belongs to. Defaults to the default.group config value (env: CHAINGUARD_DEFAULT_GROUP).
      --policy string          The name or UIDP of the custom policy to update.
      --resource-type string   Resource type used to disambiguate a policy referenced by name (shorthand: Repo, Python, Java, Javascript; or a full type). Ignored when the policy is given by UIDP.
```

### Options inherited from parent commands

```
      --api string         The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
      --audience string    The Chainguard token audience to request. (default "https://console-api.enforce.dev")
      --config string      A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
      --console string     The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
      --force-color        Force color output even when stdout is not a TTY.
  -h, --help               Help for chainctl
      --issuer string      The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
      --log-level string   Set the log level (debug, info) (default "ERROR")
  -o, --output string      Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
  -v, --v int              Set the log verbosity level.
```

### SEE ALSO

* [chainctl policy custom](/platform/chainctl/chainctl-docs/chainctl_policy_custom/)	 - Manage your custom policies.