> ## Documentation Index > Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL. > Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other. > Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking. > Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify. # Manage a PCR Policy > View, update, and reset the PCR policy for a node using the ZCLI command-line interface. ## Introduction This procedure explains how to view, set, and reset the device-level PCR (Platform Configuration Register) policy for a node using ZCLI. Operators use this procedure to customize which PCR indexes EVE-OS (Edge Virtualization Engine) uses when sealing the vault encryption key into the TPM, or to remove a custom policy after making changes. A node that has no device-level PCR policy uses the project or system default. When you set a policy, ZCLI compares it against a recommended set of PCR indexes (0, 1, 2, 3, 4, 6, 7, 8, 9, 13, and 14) and warns you about any differences. PCR 5 is never allowed in a policy because its value changes across reboots. For background on what PCR policies are and why they matter, see [Flexible PCR Policy](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/flexible-pcr-policy.md) and [TPM PCR Index Security Implications](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/tpm-pcr-security.md). ## Prerequisites * Node with a TPM 2.0 implementation (discrete or firmware) and SHA-256 PCR bank support. * [ZCLI installed and configured](https://zededa.mintlify.site/zcli-reference/get-started.md) with access to Edge Infrastructure Services. * You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md). * Remote attestation configured for the project. ## View the Current PCR Policy Run the following command to retrieve the device-level PCR policy for a specific node. Replace `` with the node name, or use `--uuid=` with the node's UUID instead. ```text theme={"dark"} zcli edge-node pcr-policy show ( | --uuid=) ``` The output displays the node name, the policy version, the PCR indexes in the policy, and a description of each index: ```text theme={"dark"} Edge node: Policy version: 2 PCR indices: [0, 1, 2, 3, 4, 6, 7, 8, 9, 13, 14] PCR descriptions: PCR 0: Core Root of Trust Measurement (CRTM/BIOS) [REQUIRED] PCR 1: Platform Configuration PCR 2: Option ROM Code ... PCR 14: Boot Authority Measurement ``` If the node has no device-level policy, ZCLI displays the following message instead: ```text theme={"dark"} Edge node '' has no device-level PCR policy (uses project or system defaults). ``` ## Set the PCR Policy Apply a custom PCR policy to a node. The `--pcrs` option is required. Use the node name, or use `--uuid=` instead. ```text theme={"dark"} zcli edge-node pcr-policy set ( | --uuid=) --pcrs= [--force] [--confirm-risks] ``` ### Specify PCR indexes The `--pcrs` value accepts individual indexes, ranges, or a combination of both, separated by commas. **Comma-separated list.** Specify indexes directly: ```text theme={"dark"} zcli edge-node pcr-policy set --pcrs=0,1,2,3,4,6,7,8,9,13,14 ``` **Range notation.** Use a hyphen for consecutive indexes: ```text theme={"dark"} zcli edge-node pcr-policy set --pcrs=0-4,6,7,13,14 ``` ZCLI rejects the list and does not contact Edge Infrastructure Services if any of the following are true: * An index is outside the range 0 to 15. * The list includes PCR 5. * The list includes the same index more than once, including through overlapping ranges. * The list does not include PCR 0. * A range is malformed, or its start is greater than its end. ## ZCLI Security Safeguards ### Policy change review When you run `pcr-policy set`, ZCLI first displays the node name and the new policy. If the node already has a device-level policy, ZCLI also lists the indexes that the new policy removes or adds compared to the current one: ```text theme={"dark"} Edge node: New PCR policy: [0, 1, 2, 3, 4, 6, 7, 13, 14, 15] Changes vs current policy: - remove PCR 8: Boot Component Configuration - remove PCR 9: Reserved + add PCR 15: Reserved ``` If the new policy is identical to the current one, ZCLI displays `No changes vs current policy.` and stops. Add `--force` to apply the policy anyway. ### Security warnings ZCLI then compares the new policy against the recommended set (0, 1, 2, 3, 4, 6, 7, 8, 9, 13, and 14). If the new policy leaves out any recommended index, ZCLI lists those indexes with the following warning: ```text theme={"dark"} WARNING: The following recommended PCRs are NOT included: PCR 8: Boot Component Configuration PCR 9: Reserved Excluding these PCRs may allow volume keys to be unsealed on a compromised or tampered device. ``` If the new policy includes an index outside the recommended set, ZCLI lists those indexes with the following note: ```text theme={"dark"} NOTE: The following non-default PCRs will be added: PCR 15: Reserved Adding PCRs that change during normal platform updates (e.g. firmware upgrades) can cause key unsealing to fail. ``` Add an index outside the recommended set (10, 11, 12, or 15) only if your platform firmware or a trusted component measures into it in a stable way. ### Confirmation ZCLI asks you to confirm before it applies the policy. Enter `y` to apply the policy, or any other key to cancel: ```text theme={"dark"} Set PCR policy for edge node ''? [y/N] ``` After the policy is applied, ZCLI displays the following message and increments the policy version by one: ```text theme={"dark"} PCR policy updated successfully for edge node ''. ``` ### Skip the prompts in scripts For scripted workflows, specify both `--force` and `--confirm-risks` to skip the warnings and the confirmation prompt. If you specify only one of the two flags, ZCLI still displays the warnings and asks for confirmation. ```text theme={"dark"} zcli edge-node pcr-policy set --pcrs=0,1,7 --force --confirm-risks ``` ## Reset the PCR Policy Remove the device-level PCR policy from a node. After the reset, the node uses the project or system default policy. Use the node name, or use `--uuid=` instead. ```text theme={"dark"} zcli edge-node pcr-policy reset ( | --uuid=) [-f] ``` ZCLI asks you to confirm the reset. Enter `y` to continue. To skip the prompt, add `-f`: ```text theme={"dark"} Reset PCR policy for edge node ''? [y/N] ``` After the reset, ZCLI displays the following message: ```text theme={"dark"} PCR policy removed from edge node ''. ``` If the node has no device-level policy, ZCLI displays `Edge node '' has no device-level PCR policy to reset.` and makes no change. ## Verify the Configuration After a set or reset operation, run the show command to confirm the result: ```text theme={"dark"} zcli edge-node pcr-policy show ``` After a set operation, confirm that **PCR indices** lists the expected indexes and that **Policy version** has increased by one. After a reset operation, confirm that the output says the node has no device-level PCR policy. In the normal case, a policy change does not interrupt the node. When EVE-OS receives the new policy it unseals the vault key under the old policy and re-seals it under the new one, without a reboot and without contacting Edge Infrastructure Services for attestation. If the vault does become inaccessible after a policy change, it means the local unseal failed because the PCR values had already drifted from those recorded at the last sealing. In that case EVE-OS first tries to recover the correct policy locally by testing candidate PCR subsets against the sealed key. If that also fails, EVE-OS initiates remote attestation to retrieve the backup vault key from Edge Infrastructure Services and re-seals it under the current policy. ## In This Series * [Remote Attestation Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/remote-attestation.md). * [Trusted Platform Module (TPM) Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/tpm-overview.md). * [Factors Affecting PCR\[1\]](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/pcr1-factors). * [Host Platform Configuration (PCR 1) Interpretation Guide](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/pcr1-interpretation-guide.md). * [TPM PCR Index Security Implications](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/tpm-pcr-security.md). * [Excluded PCRs: Disk-Key Sealing vs. Attestation Template](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/pcr-sealing-vs-attestation.md). * [Flexible PCR Policy](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/flexible-pcr-policy.md). * **Manage a PCR Policy** (this article).