Stack policies
Enforce and automate infrastructure stack approvals with Rego
Stack policies evaluate infrastructure plans before an approval-gated stack run proceeds. They can reject a run that violates a guardrail, automatically approve a known-safe plan, or leave the run undecided so it continues to the configured human or AI approval flow.
Stack policies use the plrl.stack Rego package.
Supported input
Plural evaluates a stack policy with the following top-level input:
Field | Description |
|---|---|
input.plan | A reduced Terraform plan containing terraform_version and resource_changes |
input.run_type | The run operation: plan, apply, or destroy |
input.stack | Stack metadata, including its name, project, and Git configuration |
input.commit | Metadata for the commit associated with the run |
input.actor | The initiating user, including id, name, email, and groups when available |
Each entry in input.plan.resource_changes contains:
Field | Description |
|---|---|
address | Full Terraform resource address |
type | Terraform resource type, such as aws_eks_cluster |
name | Resource name |
provider | Short provider name |
change.actions | Planned actions, such as create, update, delete, or replace |
change.before | Resource state before the run |
change.after | Expected resource state after the run |
Decisions
A stack policy can produce:
deny[{"msg": "..."}]: reject the stack runapprove[{"reason": "..."}]: approve the stack rundefer: leave the decision to the next configured approval step