User Guide

This guide is the starting point for using OCI Policy Analysis after the application is installed. The root README is intentionally a short launch guide; this page and the linked references contain the detail.

Choose an application mode

Desktop application: local Tkinter workflow with the full tabbed interface.
Web application: browser workflow for local or server-hosted use.
CLI: scripted loading, filtering, and export.
MCP: policy and identity queries for MCP clients.

For a capability comparison and the relationship between the modes, see the overview.

First run

Complete the general setup.
Follow the Desktop or Web launch guide.
Choose the dataset you will analyze:
- Live tenancy data: configure an OCI user/API-key profile, session token, instance principal, or resource principal. An OCI administrator must also grant the required IAM permissions to the principal that runs the tool.
- CIS Compliance output: use a directory produced by the CIS Compliance script, then import it with Load Compliance Data. This path does not require OCI credentials in OCI Policy Analysis.
- Combined cache: open a cache previously saved by the application when you need repeatable or offline analysis.
Load the chosen data source from Settings in desktop mode or the web home page, then start with the policy analysis workflow described in UI usage.

Core workflows

Policy and identity analysis

The UI supports policy browsing, principal analysis, policy history, workload principals, permissions reports, and cross-tenancy analysis. The UI usage guide describes the available desktop tabs and web pages.

Advanced policy analysis

Simulation evaluates policy statements against OCI API operations.
Recommendations explains risk, overlap, cleanup, and consolidation analysis.
Tag-based policy search covers parsed tag conditions and policy metadata.
OKE workload identity covers namespace and service-account queries.
Limited Compliance Loading explains policy-and-compartments-only CIS imports.
Limited Web User documents restricted web access profiles.

Troubleshooting and deployment

Use logging and troubleshooting for runtime diagnostics. For server deployments, see web setup, containerized MCP, and MCP OAuth.

Reference map

The architecture page explains the runtime layers and data flow. The API reference documents the maintained Python surface. The MCP examples provide concrete query patterns.