create-policy

Create Policy

Create OPA governance policies for Harness Software Supply Chain Assurance (SCS) via MCP.

Instructions

Step 1: Identify Policy Requirements

Determine what the policy should enforce:

• What entity type is the policy targeting? (pipeline, service, environment, feature flag, etc.)
• What is the enforcement action (warn, deny)?
• What scope should the policy apply to?
• What action triggers the policy? (onrun, onsave, onstep, etc.)

For writing Rego policies, consult references/rego-writing-guide.md for the complete Rego writing rules, entity types, package names, and common patterns. For entity-specific schemas and examples, see the entity reference files listed in that guide.

Step 2: Create the Policy

Call MCP tool: harness_create
Parameters:
  resource_type: "policy"
  org_id: "<organization>"
  project_id: "<project>"
  body: <policy definition>

OPA policies are managed under the governance toolset — resource_type: "policy" supports full CRUD (list, get, create, update, delete).

Step 3: Verify Compliance Results

After a policy is created, check compliance status on artifacts or repositories:

Call MCP tool: harness_list
Parameters:
  resource_type: "scs_compliance_result"
  org_id: "<organization>"
  project_id: "<project>"

Common Policy Patterns

Require SBOM Generation

Enforce that all artifacts have an SBOM before deployment:

package harness.artifact

deny[msg] {
  not input.artifact.sbom
  msg := "Artifact must have an SBOM before deployment"
}

Block Critical Vulnerabilities

Deny deployment of artifacts with critical CVEs:

package harness.artifact

deny[msg] {
  vuln := input.artifact.vulnerabilities[_]
  vuln.severity == "CRITICAL"
  msg := sprintf("Critical vulnerability %s found in artifact", [vuln.cve_id])
}

Enforce Approved Base Images

Restrict container images to approved base images:

package harness.artifact

approved_bases := {"alpine", "distroless", "ubuntu"}

deny[msg] {
  not approved_bases[input.artifact.base_image]
  msg := sprintf("Base image '%s' is not in the approved list", [input.artifact.base_image])
}