diff --git a/cmd/climc/shell/identity/policies.go b/cmd/climc/shell/identity/policies.go
index 65af352c0f..67ed2f513a 100644
--- a/cmd/climc/shell/identity/policies.go
+++ b/cmd/climc/shell/identity/policies.go
@@ -39,10 +39,17 @@ import (
 	"yunion.io/x/onecloud/pkg/util/tagutils"
 )
 
-func createPolicy(s *mcclient.ClientSession, name string, policy string, domain string, enabled bool, disabled bool, desc string, scope string, isSystem *bool, objectags, projecttags, domaintags tagutils.TTagSet) error {
+func createPolicy(s *mcclient.ClientSession, name string, genName string, policy string, domain string, enabled bool, disabled bool, desc string, scope string, isSystem *bool, objectags, projecttags, domaintags tagutils.TTagSet) error {
 	params := jsonutils.NewDict()
-	params.Add(jsonutils.NewString(name), "name")
-	params.Add(jsonutils.NewString(name), "type")
+	if len(genName) > 0 {
+		params.Add(jsonutils.NewString(genName), "generate_name")
+		params.Add(jsonutils.NewString(genName), "type")
+	} else if len(name) > 0 {
+		params.Add(jsonutils.NewString(name), "name")
+		params.Add(jsonutils.NewString(name), "type")
+	} else {
+		return fmt.Errorf("mising name")
+	}
 	params.Add(jsonutils.NewString(policy), "policy")
 	if len(domain) > 0 {
 		params.Add(jsonutils.NewString(domain), "project_domain_id")
@@ -83,7 +90,31 @@ func createPolicy(s *mcclient.ClientSession, name string, policy string, domain
 	printObject(result)
 
 	return nil
+}
 
+func createPolicyFromJson(s *mcclient.ClientSession, old jsonutils.JSONObject, argsName, genName, argsDomain, argsScope string) error {
+	policy, _ := old.GetString("policy")
+	enabled, _ := old.Bool("enabled")
+	desc, _ := old.GetString("description")
+	scope, _ := old.GetString("scope")
+	if len(argsScope) > 0 {
+		scope = argsScope
+	}
+	isSystem, _ := old.Bool("is_system")
+	var objectTags, projectTags, domainTags tagutils.TTagSet
+	if old.Contains("object_tags") {
+		objectTags = make(tagutils.TTagSet, 0)
+		old.Unmarshal(&objectTags, "object_tags")
+	}
+	if old.Contains("project_tags") {
+		projectTags = make(tagutils.TTagSet, 0)
+		old.Unmarshal(&projectTags, "project_tags")
+	}
+	if old.Contains("domain_tags") {
+		domainTags = make(tagutils.TTagSet, 0)
+		old.Unmarshal(&domainTags, "domain_tags")
+	}
+	return createPolicy(s, argsName, genName, policy, argsDomain, enabled, !enabled, desc, scope, &isSystem, objectTags, projectTags, domainTags)
 }
 
 func init() {
@@ -119,10 +150,40 @@ func init() {
 		objectTags := baseoptions.SplitTag(args.ObjectTags)
 		projectTags := baseoptions.SplitTag(args.ProjectTags)
 		domainTags := baseoptions.SplitTag(args.DomainTags)
-		return createPolicy(s, args.NAME, string(policyBytes), args.Domain, args.Enabled, args.Disabled, args.Desc, args.Scope, args.IsSystem, objectTags, projectTags, domainTags)
+		return createPolicy(s, args.NAME, "", string(policyBytes), args.Domain, args.Enabled, args.Disabled, args.Desc, args.Scope, args.IsSystem, objectTags, projectTags, domainTags)
+	})
+
+	type PolicyExportOptions struct {
+		ID string `json:"id"`
+	}
+	R(&PolicyExportOptions{}, "policy-export", "Export a policy", func(s *mcclient.ClientSession, args *PolicyExportOptions) error {
+		ret, err := modules.Policies.Get(s, args.ID, nil)
+		if err != nil {
+			return err
+		}
+		fmt.Println(ret.PrettyString())
+		return nil
+	})
+
+	type PolicyImportOptions struct {
+		FILE   string `json:"id"`
+		Domain string `help:"domain of the policy"`
+	}
+	R(&PolicyImportOptions{}, "policy-import", "Import a policy", func(s *mcclient.ClientSession, args *PolicyImportOptions) error {
+		cont, err := ioutil.ReadFile(args.FILE)
+		if err != nil {
+			return err
+		}
+		jsonCont, err := jsonutils.Parse(cont)
+		if err != nil {
+			return err
+		}
+		name, _ := jsonCont.GetString("name")
+		return createPolicyFromJson(s, jsonCont, "", name, args.Domain, "")
 	})
 
 	type PolicyCloneOptions struct {
+		Scope  string `help:"scope of policy"`
 		Domain string `help:"domain of the policy"`
 		OLD    string `help:"name or id of the old policy"`
 		NAME   string `help:"name of the policy"`
@@ -132,25 +193,7 @@ func init() {
 		if err != nil {
 			return err
 		}
-		policy, _ := old.GetString("policy")
-		enabled, _ := old.Bool("enabled")
-		desc, _ := old.GetString("description")
-		scope, _ := old.GetString("scope")
-		isSystem, _ := old.Bool("is_system")
-		var objectTags, projectTags, domainTags tagutils.TTagSet
-		if old.Contains("object_tags") {
-			objectTags = make(tagutils.TTagSet, 0)
-			old.Unmarshal(&objectTags, "object_tags")
-		}
-		if old.Contains("project_tags") {
-			projectTags = make(tagutils.TTagSet, 0)
-			old.Unmarshal(&projectTags, "project_tags")
-		}
-		if old.Contains("domain_tags") {
-			domainTags = make(tagutils.TTagSet, 0)
-			old.Unmarshal(&domainTags, "domain_tags")
-		}
-		return createPolicy(s, args.NAME, policy, args.Domain, enabled, !enabled, desc, scope, &isSystem, objectTags, projectTags, domainTags)
+		return createPolicyFromJson(s, old, args.NAME, "", args.Domain, args.Scope)
 	})
 
 	type PolicyPatchOptions struct {