Policy gate: plan to verdict

Policy gate: plan to verdict An architecture diagram generated by Archify. Developer · authors TF plan · Architecture component Developer authors TF plan Normalized plan · roles plus inline · Architecture component Normalized plan roles plus inline Rego policy · 3 deny rules · Architecture component Rego policy 3 deny rules gate.sh · check fmt test fixtures · Architecture component gate.sh check fmt test fixtures OPA · PDP evaluator · Architecture component OPA PDP evaluator Decision · allow or deny · Architecture component Decision allow or deny CI · blocks the merge · Architecture component CI blocks the merge Legend Backend Security External

Prevention, not history

  • • One Rego source, two enforcement points, no drift
  • • Vulnerable and malformed inputs denied, clean allowed