oh policy
Import, sync and inspect access-control policies on an external catalog (e.g. a Unity catalog).
A policy workflow is: inspect the diff with oh policy show --diff, pass the returned change file to oh policy import or oh policy sync (and optionally oh policy grant / oh policy revoke), and later clear state with oh policy reset.
Diff directions: IMPORT SYNC
oh policy show
Shows the policies on a catalog, or the diff that an import or sync would apply.
| Flag | Required | Description |
|---|---|---|
--catalog | Yes | Catalog name (e.g. a Unity catalog) |
--diff | No | IMPORT or SYNC — show what that direction would change instead of the current policies |
# Current policies on the catalog
oh policy show --catalog unity-prod
# What `oh policy import` would change
oh policy show --catalog unity-prod --diff IMPORT
oh policy import
Pulls policies from the catalog into Onehouse, applying the changes listed in a change file (typically produced by oh policy show --diff IMPORT).
| Flag | Required | Description |
|---|---|---|
--catalog | Yes | Catalog name |
--changes-path | Yes | URL of the JSON change list, e.g. the path oh policy show --diff IMPORT returned |
oh policy import \
--catalog unity-prod \
--changes-path s3://my-bucket/policy-diffs/import-2026-10-29.json
oh policy sync
Pushes Onehouse policies out to the catalog.
| Flag | Required | Description |
|---|---|---|
--catalog | Yes | Catalog name |
--changes-path | Yes | URL of the JSON change list, e.g. the path oh policy show --diff SYNC returned |
oh policy sync \
--catalog unity-prod \
--changes-path s3://my-bucket/policy-diffs/sync-2026-10-29.json
oh policy grant
Grants the privileges listed in the change file.
| Flag | Required | Description |
|---|---|---|
--catalog | Yes | Catalog name |
--changes-path | Yes | URL of the JSON change list |
oh policy grant \
--catalog unity-prod \
--changes-path s3://my-bucket/policy-diffs/grants-2026-10-29.json
oh policy revoke
Revokes the privileges listed in the change file.
| Flag | Required | Description |
|---|---|---|
--catalog | Yes | Catalog name |
--changes-path | Yes | URL of the JSON change list |
oh policy revoke \
--catalog unity-prod \
--changes-path s3://my-bucket/policy-diffs/revokes-2026-10-29.json
oh policy reset
Clears every policy Onehouse holds for the project, across all catalogs. The external catalogs are not changed; Onehouse stops tracking the policies. The command prompts for confirmation unless --yes is passed, since it is project-wide and one mistyped command clears everything.
| Flag | Description |
|---|---|
--yes | Skip the confirmation prompt |
oh policy reset
oh policy reset --yes