# Harness Policy Governance

> >

- **Type:** Skill
- **Install:** `agentstack add skill-dungnotnull-hybrid-harness-chaos-process-prm-s24-policy-governance`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [dungnotnull](https://agentstack.voostack.com/s/dungnotnull)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [dungnotnull](https://github.com/dungnotnull)
- **Source:** https://github.com/dungnotnull/hybrid-harness-chaos-process-prm/tree/main/skills/s24-policy-governance

## Install

```sh
agentstack add skill-dungnotnull-hybrid-harness-chaos-process-prm-s24-policy-governance
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Harness Policy Governance (OPA)

## Purpose
Encode organizational compliance, security, and operational standards as machine-enforceable OPA policies that block or warn on violations before harm occurs — rather than detecting problems after deployment.

---

## Input Contract

| Input | Source | Required |
|---|---|---|
| All pipeline YAML outputs | s04, s09 | Yes |
| Compliance requirements | s01 PRD | Yes |
| Blast radius policies | s14 output | Yes |
| Template enforcement needs | s09 output | No |
| Cost governance needs | s23 output | No |
| Risk tolerance preferences | s02 taste (risk_tolerance) | Yes |

## Output Contract

| Output | Destination | Format |
|---|---|---|
| OPA policy set YAML | `.commandcode/artifacts/policy-set.yaml` | YAML |
| Pipeline tagging policy | `.commandcode/artifacts/policy-tagging.rego` | Rego |
| Deployment window policy | `.commandcode/artifacts/policy-deploy-window.rego` | Rego |
| Production approval policy | `.commandcode/artifacts/policy-approval.rego` | Rego |
| Container security policy | `.commandcode/artifacts/policy-security.rego` | Rego |
| Chaos gate policy | `.commandcode/artifacts/policy-chaos-gate.rego` | Rego |
| Cost governance policy | `.commandcode/artifacts/policy-cost.rego` | Rego |
| Policy audit report | s25 (postmortem context) | Markdown |

---

## Prerequisites
- [ ] Harness Policy Engine module enabled
- [ ] OPA basics understood (Rego language)
- [ ] Compliance requirements documented (required tags, approval rules, deployment windows)
- [ ] RBAC roles defined (who can override a policy warning)

---

## Policy Enforcement Points

Harness evaluates OPA policies at these events:

| Event | Policies Evaluated On |
|---|---|
| `OnSave` | Entity YAML saved in UI or API |
| `OnRun` | Before pipeline execution begins |
| `OnStep` | Before specific step executes |
| `OnStepComplete` | After step completes |

---

## Policy Structure (Rego)

```
package 

# Always include:
deny[reason] {
  # condition that should NOT be true
  # reason: human-readable explanation string
}

warn[reason] {
  # non-blocking warning condition
}
```

---

## Essential Policies

### Policy 1: Required Pipeline Tags
```rego
package pipeline_tagging

# Every pipeline must have team and domain tags
deny[sprintf("Pipeline '%s' missing required tag 'team'", [input.pipeline.name])] {
  not has_tag("team")
}

deny[sprintf("Pipeline '%s' missing required tag 'domain'", [input.pipeline.name])] {
  not has_tag("domain")
}

has_tag(key) {
  tag := input.pipeline.tags[_]
  tag.key == key
}
```

### Policy 2: Production Deployment Window
```rego
package deployment_window

import future.keywords.if

# Block production deployments outside business hours (UTC)
deny["Production deployments only allowed Mon-Fri 09:00-17:00 UTC"] {
  is_production_deployment
  not in_deployment_window
}

is_production_deployment if {
  stage := input.pipeline.stages[_].stage
  stage.spec.environment.environmentRef == "production"
}

in_deployment_window if {
  # time.weekday: 0=Sunday, 1=Monday ... 6=Saturday
  day := time.weekday(time.now_ns())
  day >= 1
  day = 9
  hour = 80, got %d",
             [step.identifier, step.spec.expectedResilienceScore])] {
  stage := input.pipeline.stages[_].stage
  step := stage.spec.execution.steps[_].step
  step.type == "Chaos"
  step.spec.expectedResilienceScore 
  projectIdentifier: 
  enabled: true
  policies:
    - policyIdentifier: pipeline_tagging
      severity: error      # error = deny, warning = warn-only
    - policyIdentifier: mandatory_approval
      severity: error
    - policyIdentifier: deployment_window
      severity: warning    # warn but don't block (allow override)
    - policyIdentifier: rollback_required
      severity: error
    - policyIdentifier: secret_hygiene
      severity: error
    - policyIdentifier: chaos_gate
      severity: error
  type: pipeline
  executionType: OnRun
```

---

## Testing Policies Locally

```bash
# Install OPA CLI
curl -L -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64_static
chmod +x opa

# Test policy against a pipeline YAML
# 1. Convert pipeline YAML to JSON
python3 -c "
import sys, yaml, json
with open('pipeline.yaml') as f:
    data = yaml.safe_load(f)
print(json.dumps({'pipeline': data.get('pipeline', data)}, indent=2))
" > pipeline_input.json

# 2. Evaluate policy
opa eval \
  --input pipeline_input.json \
  --data policy.rego \
  'data.mandatory_approval.deny'

# 3. Expected output for compliant pipeline:
# {"result": [{"expressions": [{"value": [], ...}]}]}
# Empty array = no violations = PASS
```

---

## RBAC: Who Can Override Policy Warnings

```yaml
# Harness RBAC Role — Policy Override
role:
  name: Policy Override Approver
  identifier: policy_override_approver
  permissions:
    - core_governancepolicy_override
  allowedScopeLevels: [project]
```

Grant this role only to: Engineering Directors, SRE Leads, Release Managers.

---

## AI Agent Integration

### Autonomy Level

| Aspect | Level | Description |
|---|---|---|
| Current | L2 | AI generates OPA Rego policies from natural language |
| Target | L3 | AI maintains policy library and detects violations |

### Harness AI Agent

**Agent**: Harness AI DevOps Agent
**Capabilities**:
- OPA Rego policy generation from natural language
- Compliance gate design
- Policy violation detection and notification

### Human Gates

- Policy activation
- Compliance exception approval
- Governance framework changes

---

## Success Criteria
- [ ] Core policy set active with `OnRun` enforcement
- [ ] All 7 essential policies above implemented and tested
- [ ] Policy violations surfaced in pipeline execution UI with clear messages
- [ ] Local OPA testing verified before deploying new policies
- [ ] Override process documented (who, when, audit trail)
- [ ] Monthly policy audit report generated via Harness API

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [dungnotnull](https://github.com/dungnotnull)
- **Source:** [dungnotnull/hybrid-harness-chaos-process-prm](https://github.com/dungnotnull/hybrid-harness-chaos-process-prm)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-dungnotnull-hybrid-harness-chaos-process-prm-s24-policy-governance
- Seller: https://agentstack.voostack.com/s/dungnotnull
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.