# chainctl policy override

URL: https://chainguard-docs-preview-git-athena-mention.chainguard.app/platform/chainctl/chainctl-docs/chainctl_policy_override.md
Last Modified: October 12, 2026
Tags: chainctl, Reference, Product

## chainctl policy override

Manage policy overrides.

### Synopsis

A policy override is an admin-granted waiver that flips a DENIED
policy result to ALLOWED for one specific artifact. It does not change
the policy or its binding; it records a deliberate, attributable
exception that the engine applies after evaluation.

Each override names exactly one policy and one artifact. Creating an
override requires the policies.override.create capability, which is
typically held by organization owners.

### Options inherited from parent commands

```
      --api string         The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
      --audience string    The Chainguard token audience to request. (default "https://console-api.enforce.dev")
      --config string      A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
      --console string     The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
      --force-color        Force color output even when stdout is not a TTY.
  -h, --help               Help for chainctl
      --issuer string      The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
      --log-level string   Set the log level (debug, info) (default "ERROR")
  -o, --output string      Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
  -v, --v int              Set the log verbosity level.
```

### SEE ALSO

* [chainctl policy](/platform/chainctl/chainctl-docs/chainctl_policy/)	 - Manage policies.
* [chainctl policy override create](/platform/chainctl/chainctl-docs/chainctl_policy_override_create/)	 - Create a policy override.
* [chainctl policy override delete](/platform/chainctl/chainctl-docs/chainctl_policy_override_delete/)	 - Delete a policy override.
* [chainctl policy override list](/platform/chainctl/chainctl-docs/chainctl_policy_override_list/)	 - List policy overrides.