{
  "slug": "railway-iac-project-variables-policy-controls-variable-diffs-b3abcdfe5b21",
  "title": "railway IaC project variables policy controls variable diffs",
  "tools": [
    "railway"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-08T08:39:15.000Z",
  "announced_at": "2026-10-08T08:39:15.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When IaC should not own some or all project variables, set the project-level `variables` policy: `ignore` excludes matching keys from both sides of the diff, and `managed: false` prevents variable sets and deletes. A service declaring `env` or `variables` is an error when `managed` is false.",
    "examples": [
      "project(\"example\", { variables: { managed: true, ignore: [\"SECRETS_*\", \"web/*\"] }, resources: [...] })",
      "railway config plan",
      "railway config apply"
    ],
    "gotchas": [
      "Version: v5.64.0",
      "variables.managed: Boolean ownership setting. `false` prevents variable sets and deletes; services declaring `env` or `variables` then cause an error. Defaults to `true` when the policy is absent.",
      "variables.ignore: Array of key patterns to exclude from both sides of the diff; ignored keys are never set or deleted. Defaults to `[]`.",
      "variables.ignore` pattern `KEY_GLOB`: Matches that key on every service. Only `*` is special; matching is case-sensitive and applies to the full key.",
      "variables.ignore` pattern `service/KEY_GLOB`: Matches keys only on the named resource. Only `*` is special; matching is case-sensitive and applies to the full key.",
      "Prerequisite: Install the CLI and authenticate; connect the current directory to the target project and environment with `railway link`.",
      "Prerequisite: Install the matching IaC authoring package: TypeScript `npm install railway`; Python `pip install railway-sdk`; Go `go get github.com/railwayapp/railway-go-sdk@v0.3.0`. Python and Go authoring are beta.",
      "`KEY_GLOB` matches that key on every service; `service/KEY_GLOB` matches only on the named resource.",
      "Only `*` is special; matching is case-sensitive and applies to the full key.",
      "Ignored keys are removed from both sides before diffing and are never set or deleted.",
      "With `managed: false`, a service declaring `env` or `variables` is an error.",
      "The policy defaults to `{ managed: true, ignore: [] }` when absent."
    ]
  },
  "why_it_matters": "Configure IaC variable ownership and ignored keys when planning or applying project configuration.",
  "before": "Before this change, a desired service with no `env` could delete every remote variable; `preserve()` only protected variables per key.",
  "sources": [
    "https://github.com/railwayapp/cli/releases/tag/v5.64.0",
    "https://github.com/railwayapp/cli/pull/1256",
    "https://docs.railway.com/infrastructure-as-code"
  ],
  "rank": 0.92025,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-98f5b7c3348bda5a-1:gate",
    "evidence_hash": "4bb8c1fb47dcc71738222340368bc52dad9b00f2b5970ad807aebb4379d11777"
  },
  "review": {
    "draft_hash": "f5bb45ccb03e7cadc8419b5cdec37cd98198c6c1cc3f2fa2686cd9f6e81d3225",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-08T08:39:15.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.71 (>= 0.6 needed)."
  }
}