Policy engine
opspolicy-engine
Evaluates resources against governance rules and audits or blocks them.
- Category
- Operations
- Properties
- 6
- Components
- 57
- Rules
- 0
A node of this kind resolves each property from its own props, then the component's defaults, then the default below.
| property | type | values | required | default |
|---|---|---|---|---|
| effect | enum | audit | deny | modify | deploy-if-not-exists | no | — |
| enforcementMode | enum | enforced | disabled | no | — |
| managed | boolean | — | no | false |
| policyCount | integer | — | no | — |
| remediation | boolean | — | no | false |
| scope | enum | resource | group | account | organization | no | — |
No rule selects this kind or its category. Governance calls that a recorded gap.
vendor-neutral
aws
Amazon CodeGuru Revieweraws-codeguru-reviewerAWS Configaws-configAWS Control Toweraws-control-towerIAM Access Analyzeraws-iam-access-analyzerAWS Lake Formationaws-lake-formationAWS License Manageraws-license-managerAWS Organizationsaws-organizationsAWS Resource Access Manageraws-ramAmazon Verified Permissionsaws-verified-permissions
azure
default
CalypsoAIcalypsoaiCerboscerbosOPA GatekeepergatekeeperGuardrails AIguardrails-aiHiddenLayer AI Security PlatformhiddenlayerKubeArmorkubearmorKubewardenkubewardenKyvernokyvernoLakera Guardlakera-guardLLM Guardllm-guardNeMo Guardrailsnemo-guardrailsOpen Policy AgentopaPermit.iopermit-ioPrompt Securityprompt-securityProtect AIprotect-aiRebuffrebuffRobust Intelligencerobust-intelligenceSonarQube Serversonarqube
digitalocean
gcp
Access Context Managergoogle-access-context-managerAssured Workloadsgoogle-assured-workloadsBinary Authorizationgoogle-binary-authorizationIdentity and Access Managementgoogle-cloud-iamFirebase App Checkgoogle-firebase-app-checkModel Armorgoogle-model-armorOrganization Policy Servicegoogle-organization-policyPolicy Controllergoogle-policy-controllerPrivileged Access Managergoogle-privileged-access-managerVPC Service Controlsgoogle-vpc-service-controls
oci
Oracle Access Governanceoci-access-governanceOracle API Access Controloci-api-access-controlOracle Data Safeoci-data-safeOracle Delegate Access Controloci-delegate-access-controlOCI IAM Policyoci-iam-policyOCI Managed Accessoci-managed-accessOracle Operator Access Controloci-operator-access-controlOCI Security Zonesoci-security-zoneOCI Zero Trust Packet Routingoci-zero-trust-packet-routing
# yaml-language-server: $schema=../schema/kind.schema.json # Governance, not observation: monitoring reports, a policy engine decides. effect and enforcementMode have no default because an assignment left in audit, or disabled, is exactly what a rule should surface. schemaVersion: "1" type: "kind" id: "policy-engine" category: "ops" properties: effect: type: "enum" values: ["audit", "deny", "modify", "deploy-if-not-exists"] enforcementMode: type: "enum" values: ["enforced", "disabled"] scope: type: "enum" values: ["resource", "group", "account", "organization"] remediation: type: "boolean" default: false policyCount: type: "integer" managed: type: "boolean" default: false