Policy enforcement
Extend Plural authorization and approval workflows with policy as code
Plural policies let platform and security teams encode enterprise guardrails in Rego. Policies are evaluated alongside Plural's built-in RBAC and approval controls, adding organization-specific authorization without replacing the permissions you already configured.
Use policy enforcement to:
- Allow or deny workbench tool calls based on the actor, tool, and arguments
- Automatically approve known-safe workbench operations
- Approve or reject stack runs from the contents of an infrastructure plan
- Apply policies consistently to matching workbenches or stacks
- Test proposed policy changes against inputs captured from live evaluations
Info:
Policies only add constraints or automate an existing approval step. They do not grant access that the actor or workbench does not already have through Plural RBAC and tool permissions.
Policy types
Type | Rego package | Purpose |
|---|---|---|
| Workbench | plrl.wb.admission | Deny tool calls or automatically approve operations that require approval |
| Stack | plrl.stack | Approve or reject stack runs from plan, stack, commit, and actor data |
| Binding | plrl.binding | Select which workbenches or stacks receive another policy |
Workbench and stack policies return decisions. Binding policies return a bind decision and connect those enforcement policies to matching resources. This separation lets you reuse one guardrail across many workbenches or stacks without attaching it to each resource manually.
Decision model
Workbench and stack policies can add objects to the deny and approve sets:
deny[{"msg": "explain why the operation is blocked"}] if {
# conditions
}
approve[{"reason": "explain why the operation is safe"}] if {
# conditions
}