---
id: "policy-engine"
type: "kind"
category: "ops"
url: "https://localhost:3000/catalogue/kinds/policy-engine"
---

# Policy engine

Evaluates resources against governance rules and audits or blocks them.

| | |
|---|---|
| Category | Operations |
| Properties | 6 |
| Components | 57 |
| Rules | 0 |

## Properties

| property | type | values | required | default |
|---|---|---|---|---|
| `effect` | enum | `audit`, `deny`, `modify`, `deploy-if-not-exists` | no | — |
| `enforcementMode` | enum | `enforced`, `disabled` | no | — |
| `managed` | boolean | — | no | false |
| `policyCount` | integer | — | no | — |
| `remediation` | boolean | — | no | false |
| `scope` | enum | `resource`, `group`, `account`, `organization` | no | — |

## Rules for this kind · 0

No rule selects this kind or its category.

## Components · 57

### vendor-neutral

- [Generic policy engine](https://localhost:3000/catalogue/components/policy-engine.md) `policy-engine` — the kind itself

### alibabacloud

- [Cloud Config](https://localhost:3000/catalogue/components/alibaba-cloud-config.md) `alibaba-cloud-config` — 4 defaults
- [Data Security Center](https://localhost:3000/catalogue/components/alibaba-data-security-center.md) `alibaba-data-security-center` — 4 defaults

### aws

- [Amazon CodeGuru Reviewer](https://localhost:3000/catalogue/components/aws-codeguru-reviewer.md) `aws-codeguru-reviewer` — 4 defaults
- [AWS Config](https://localhost:3000/catalogue/components/aws-config.md) `aws-config` — 4 defaults
- [AWS Control Tower](https://localhost:3000/catalogue/components/aws-control-tower.md) `aws-control-tower` — 3 defaults
- [IAM Access Analyzer](https://localhost:3000/catalogue/components/aws-iam-access-analyzer.md) `aws-iam-access-analyzer` — 5 defaults
- [AWS Lake Formation](https://localhost:3000/catalogue/components/aws-lake-formation.md) `aws-lake-formation` — 4 defaults
- [AWS License Manager](https://localhost:3000/catalogue/components/aws-license-manager.md) `aws-license-manager` — 3 defaults
- [AWS Organizations](https://localhost:3000/catalogue/components/aws-organizations.md) `aws-organizations` — 4 defaults
- [AWS Resource Access Manager](https://localhost:3000/catalogue/components/aws-ram.md) `aws-ram` — 4 defaults
- [Amazon Verified Permissions](https://localhost:3000/catalogue/components/aws-verified-permissions.md) `aws-verified-permissions` — 5 defaults

### azure

- [Microsoft Entra Conditional Access](https://localhost:3000/catalogue/components/azure-conditional-access.md) `azure-conditional-access` — 2 defaults
- [Azure Policy](https://localhost:3000/catalogue/components/azure-policy.md) `azure-policy` — 2 defaults
- [Microsoft Entra Privileged Identity Management](https://localhost:3000/catalogue/components/azure-privileged-identity-management.md) `azure-privileged-identity-management` — 3 defaults

### cloudflare

- [Cloudflare Data Loss Prevention](https://localhost:3000/catalogue/components/cloudflare-dlp.md) `cloudflare-dlp` — 3 defaults

### default

- [CalypsoAI](https://localhost:3000/catalogue/components/calypsoai.md) `calypsoai` — 1 defaults
- [Cerbos](https://localhost:3000/catalogue/components/cerbos.md) `cerbos` — 5 defaults
- [OPA Gatekeeper](https://localhost:3000/catalogue/components/gatekeeper.md) `gatekeeper` — 5 defaults
- [Guardrails AI](https://localhost:3000/catalogue/components/guardrails-ai.md) `guardrails-ai` — 3 defaults
- [HiddenLayer AI Security Platform](https://localhost:3000/catalogue/components/hiddenlayer.md) `hiddenlayer` — 2 defaults
- [KubeArmor](https://localhost:3000/catalogue/components/kubearmor.md) `kubearmor` — 5 defaults
- [Kubewarden](https://localhost:3000/catalogue/components/kubewarden.md) `kubewarden` — 5 defaults
- [Kyverno](https://localhost:3000/catalogue/components/kyverno.md) `kyverno` — 5 defaults
- [Lakera Guard](https://localhost:3000/catalogue/components/lakera-guard.md) `lakera-guard` — 3 defaults
- [LLM Guard](https://localhost:3000/catalogue/components/llm-guard.md) `llm-guard` — 2 defaults
- [NeMo Guardrails](https://localhost:3000/catalogue/components/nemo-guardrails.md) `nemo-guardrails` — 2 defaults
- [Open Policy Agent](https://localhost:3000/catalogue/components/opa.md) `opa` — 3 defaults
- [Permit.io](https://localhost:3000/catalogue/components/permit-io.md) `permit-io` — 3 defaults
- [Prompt Security](https://localhost:3000/catalogue/components/prompt-security.md) `prompt-security` — 2 defaults
- [Protect AI](https://localhost:3000/catalogue/components/protect-ai.md) `protect-ai` — 1 defaults
- [Rebuff](https://localhost:3000/catalogue/components/rebuff.md) `rebuff` — 3 defaults
- [Robust Intelligence](https://localhost:3000/catalogue/components/robust-intelligence.md) `robust-intelligence` — 1 defaults
- [SonarQube Server](https://localhost:3000/catalogue/components/sonarqube.md) `sonarqube` — 5 defaults

### digitalocean

- [DigitalOcean CSPM](https://localhost:3000/catalogue/components/digitalocean-cspm.md) `digitalocean-cspm` — 4 defaults

### gcp

- [Access Context Manager](https://localhost:3000/catalogue/components/google-access-context-manager.md) `google-access-context-manager` — 3 defaults
- [Assured Workloads](https://localhost:3000/catalogue/components/google-assured-workloads.md) `google-assured-workloads` — 5 defaults
- [Binary Authorization](https://localhost:3000/catalogue/components/google-binary-authorization.md) `google-binary-authorization` — 5 defaults
- [Identity and Access Management](https://localhost:3000/catalogue/components/google-cloud-iam.md) `google-cloud-iam` — 4 defaults
- [Firebase App Check](https://localhost:3000/catalogue/components/google-firebase-app-check.md) `google-firebase-app-check` — 5 defaults
- [Model Armor](https://localhost:3000/catalogue/components/google-model-armor.md) `google-model-armor` — 3 defaults
- [Organization Policy Service](https://localhost:3000/catalogue/components/google-organization-policy.md) `google-organization-policy` — 5 defaults
- [Policy Controller](https://localhost:3000/catalogue/components/google-policy-controller.md) `google-policy-controller` — 3 defaults
- [Privileged Access Manager](https://localhost:3000/catalogue/components/google-privileged-access-manager.md) `google-privileged-access-manager` — 3 defaults
- [VPC Service Controls](https://localhost:3000/catalogue/components/google-vpc-service-controls.md) `google-vpc-service-controls` — 3 defaults

### ibm

- [IBM OpenPages](https://localhost:3000/catalogue/components/ibm-openpages.md) `ibm-openpages` — 4 defaults
- [IBM Cloud Security and Compliance Center](https://localhost:3000/catalogue/components/ibm-security-compliance-center.md) `ibm-security-compliance-center` — 4 defaults

### k8s

- [ValidatingAdmissionPolicy](https://localhost:3000/catalogue/components/k8s-validating-admission-policy.md) `k8s-validating-admission-policy` — 3 defaults

### oci

- [Oracle Access Governance](https://localhost:3000/catalogue/components/oci-access-governance.md) `oci-access-governance` — 3 defaults
- [Oracle API Access Control](https://localhost:3000/catalogue/components/oci-api-access-control.md) `oci-api-access-control` — 5 defaults
- [Oracle Data Safe](https://localhost:3000/catalogue/components/oci-data-safe.md) `oci-data-safe` — 4 defaults
- [Oracle Delegate Access Control](https://localhost:3000/catalogue/components/oci-delegate-access-control.md) `oci-delegate-access-control` — 5 defaults
- [OCI IAM Policy](https://localhost:3000/catalogue/components/oci-iam-policy.md) `oci-iam-policy` — 4 defaults
- [OCI Managed Access](https://localhost:3000/catalogue/components/oci-managed-access.md) `oci-managed-access` — 5 defaults
- [Oracle Operator Access Control](https://localhost:3000/catalogue/components/oci-operator-access-control.md) `oci-operator-access-control` — 5 defaults
- [OCI Security Zones](https://localhost:3000/catalogue/components/oci-security-zone.md) `oci-security-zone` — 5 defaults
- [OCI Zero Trust Packet Routing](https://localhost:3000/catalogue/components/oci-zero-trust-packet-routing.md) `oci-zero-trust-packet-routing` — 5 defaults

## Source (`kind` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../schema/kind.schema.json
# Governance, not observation: monitoring reports, a policy engine decides. effect and enforcementMode have no default because an assignment left in audit, or disabled, is exactly what a rule should surface.
schemaVersion: "1"
type: "kind"
id: "policy-engine"
category: "ops"
properties:
  effect:
    type: "enum"
    values: ["audit", "deny", "modify", "deploy-if-not-exists"]
  enforcementMode:
    type: "enum"
    values: ["enforced", "disabled"]
  scope:
    type: "enum"
    values: ["resource", "group", "account", "organization"]
  remediation:
    type: "boolean"
    default: false
  policyCount:
    type: "integer"
  managed:
    type: "boolean"
    default: false
```

Human page: https://localhost:3000/catalogue/kinds/policy-engine