docs

Policy enforcement

Extend Plural authorization and approval workflows with policy as code

Plural policies let platform and security teams encode enterprise guardrails in Rego. Policies are evaluated alongside Plural's built-in RBAC and approval controls, adding organization-specific authorization without replacing the permissions you already configured.

Use policy enforcement to:

  • Allow or deny workbench tool calls based on the actor, tool, and arguments
  • Automatically approve known-safe workbench operations
  • Deny stack runs before they are created, such as during a freeze window
  • Approve or reject stack runs from the contents of an infrastructure plan
  • Apply policies consistently to matching workbenches or stacks
  • Test proposed policy changes against inputs captured from live evaluations

Policy types

TypeRego packagePurpose
Workbenchplrl.workbenchDeny tool calls or automatically approve operations that require approval
Stackplrl.stackDeny a run before it is created, or approve or reject a plan at approval
Bindingplrl.bindingSelect which workbenches or stacks receive another policy

Workbench and stack policies return decisions. Binding policies return a bind decision and connect those enforcement policies to matching resources. This separation lets you reuse one guardrail across many workbenches or stacks without attaching it to each resource manually.

Decision model

Workbench and stack policies can add objects to the deny and approve sets:

rego
deny[{"msg": "explain why the operation is blocked"}] if {
	# conditions
}

approve[{"reason": "explain why the operation is safe"}] if {
	# conditions
}

A denial takes precedence over an approval. When no rule produces a decision:

  • A workbench tool call continues through its normal authorization and approval path.
  • A run-stage stack policy allows the run to be created.
  • An approval-stage stack run continues to its configured human or AI approval path.

Managing policies

Open Security → Policies in the Plural Console to create and edit policies, inspect attachments, review evaluations, and run simulations. Policies are project-scoped, allowing each project to apply guardrails appropriate to its resources and teams.

For a GitOps workflow, store policies and tests in Git and publish them with the Plural Terraform provider. The Plural policy examples repository demonstrates the complete workflow, including:

  • Workbench, stack, and binding policies
  • Rego unit tests and CI
  • Terraform resources that publish and bind policies
  • A Plural InfrastructureStack that deploys the configuration

Next steps

Edit on GitHub