Harness Policy Governance

Harness Policy Governance (OPA)

Purpose

Encode organizational compliance, security, and operational standards as machine-enforceable OPA policies that block or warn on violations before harm occurs — rather than detecting problems after deployment.

---

Input Contract

| Input | Source | Required | |---|---|---| | All pipeline YAML outputs | s04, s09 | Yes | | Compliance requirements | s01 PRD | Yes | | Blast radius policies | s14 output | Yes | | Template enforcement needs | s09 output | No | | Cost governance needs | s23 output | No | | Risk tolerance preferences | s02 taste (risk_tolerance) | Yes |

Output Contract

| Output | Destination | Format | |---|---|---| | OPA policy set YAML | .commandcode/artifacts/policy-set.yaml | YAML | | Pipeline tagging policy | .commandcode/artifacts/policy-tagging.rego | Rego | | Deployment window policy | .commandcode/artifacts/policy-deploy-window.rego | Rego | | Production approval policy | .commandcode/artifacts/policy-approval.rego | Rego | | Container security policy | .commandcode/artifacts/policy-security.rego | Rego | | Chaos gate policy | .commandcode/artifacts/policy-chaos-gate.rego | Rego | | Cost governance policy | .commandcode/artifacts/policy-cost.rego | Rego | | Policy audit report | s25 (postmortem context) | Markdown |

---

Prerequisites

• [ ] Harness Policy Engine module enabled
• [ ] OPA basics understood (Rego language)
• [ ] Compliance requirements documented (required tags, approval rules, deployment windows)
• [ ] RBAC roles defined (who can override a policy warning)

---

Policy Enforcement Points

Harness evaluates OPA policies at these events:

| Event | Policies Evaluated On | |---|---| | OnSave | Entity YAML saved in UI or API | | OnRun | Before pipeline execution begins | | OnStep | Before specific step executes | | OnStepComplete | After step completes |

---

Policy Structure (Rego)

package 

# Always include:
deny[reason] {
  # condition that should NOT be true
  # reason: human-readable explanation string
}

warn[reason] {
  # non-blocking warning condition
}

---

Essential Policies

Policy 1: Required Pipeline Tags

package pipeline_tagging

# Every pipeline must have team and domain tags
deny[sprintf("Pipeline '%s' missing required tag 'team'", [input.pipeline.name])] {
  not has_tag("team")
}

deny[sprintf("Pipeline '%s' missing required tag 'domain'", [input.pipeline.name])] {
  not has_tag("domain")
}

has_tag(key) {
  tag := input.pipeline.tags[_]
  tag.key == key
}

Policy 2: Production Deployment Window

package deployment_window

import future.keywords.if

# Block production deployments outside business hours (UTC)
deny["Production deployments only allowed Mon-Fri 09:00-17:00 UTC"] {
  is_production_deployment
  not in_deployment_window
}

is_production_deployment if {
  stage := input.pipeline.stages[_].stage
  stage.spec.environment.environmentRef == "production"
}

in_deployment_window if {
  # time.weekday: 0=Sunday, 1=Monday ... 6=Saturday
  day := time.weekday(time.now_ns())
  day >= 1
  day = 9
  hour = 80, got %d",
             [step.identifier, step.spec.expectedResilienceScore])] {
  stage := input.pipeline.stages[_].stage
  step := stage.spec.execution.steps[_].step
  step.type == "Chaos"
  step.spec.expectedResilienceScore 
  projectIdentifier: 
  enabled: true
  policies:
    - policyIdentifier: pipeline_tagging
      severity: error      # error = deny, warning = warn-only
    - policyIdentifier: mandatory_approval
      severity: error
    - policyIdentifier: deployment_window
      severity: warning    # warn but don't block (allow override)
    - policyIdentifier: rollback_required
      severity: error
    - policyIdentifier: secret_hygiene
      severity: error
    - policyIdentifier: chaos_gate
      severity: error
  type: pipeline
  executionType: OnRun

---

Testing Policies Locally

# Install OPA CLI
curl -L -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64_static
chmod +x opa

# Test policy against a pipeline YAML
# 1. Convert pipeline YAML to JSON
python3 -c "
import sys, yaml, json
with open('pipeline.yaml') as f:
    data = yaml.safe_load(f)
print(json.dumps({'pipeline': data.get('pipeline', data)}, indent=2))
" > pipeline_input.json

# 2. Evaluate policy
opa eval \
  --input pipeline_input.json \
  --data policy.rego \
  'data.mandatory_approval.deny'

# 3. Expected output for compliant pipeline:
# {"result": [{"expressions": [{"value": [], ...}]}]}
# Empty array = no violations = PASS

---

RBAC: Who Can Override Policy Warnings

# Harness RBAC Role — Policy Override
role:
  name: Policy Override Approver
  identifier: policy_override_approver
  permissions:
    - core_governancepolicy_override
  allowedScopeLevels: [project]

Grant this role only to: Engineering Directors, SRE Leads, Release Managers.

---

AI Agent Integration

Autonomy Level

| Aspect | Level | Description | |---|---|---| | Current | L2 | AI generates OPA Rego policies from natural language | | Target | L3 | AI maintains policy library and detects violations |

Harness AI Agent

Agent: Harness AI DevOps Agent Capabilities:

• OPA Rego policy generation from natural language
• Compliance gate design
• Policy violation detection and notification

Human Gates

• Policy activation
• Compliance exception approval
• Governance framework changes

---

Success Criteria

• [ ] Core policy set active with OnRun enforcement
• [ ] All 7 essential policies above implemented and tested
• [ ] Policy violations surfaced in pipeline execution UI with clear messages
• [ ] Local OPA testing verified before deploying new policies
• [ ] Override process documented (who, when, audit trail)
• [ ] Monthly policy audit report generated via Harness API

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: dungnotnull
• Source: dungnotnull/hybrid-harness-chaos-process-prm
• License: MIT

Install and usage instructions live in the source repository linked above.