30 lines
968 B
YAML
30 lines
968 B
YAML
|
# Sky Lattice policy pack (v0): evaluated by platformctl validate.
|
||
|
|
# Format: simple YAML rules (OPA/Conftest can wrap these later).
|
||
|
|
|
||
|
|
version: 1
|
||
|
|
rules:
|
||
|
|
- id: override_requires_decision
|
||
|
|
description: Every intent override must reference an active decision_id.
|
||
|
|
severity: error
|
||
|
|
check: overrides_have_decisions
|
||
|
|
|
||
|
|
- id: unmanaged_requires_decision
|
||
|
|
description: Unmanaged live objects should reference a decision when intentionally deferred.
|
||
|
|
severity: warning
|
||
|
|
check: unmanaged_have_decisions
|
||
|
|
|
||
|
|
- id: restricted_prod_curated_read
|
||
|
|
description: Restricted domains cannot enable prod curated read without an override + decision.
|
||
|
|
severity: error
|
||
|
|
check: restricted_prod_curated_guard
|
||
|
|
|
||
|
|
- id: no_empty_domains
|
||
|
|
description: At least one domain is required.
|
||
|
|
severity: error
|
||
|
|
check: domains_non_empty
|
||
|
|
|
||
|
|
- id: blueprint_pin_present
|
||
|
|
description: Intent must pin a blueprint version.
|
||
|
|
severity: error
|
||
|
|
check: blueprint_pinned
|