Container Registry and Software Supply Chain Platform  ·  View 09 of 33  ·  2 · Structure

Policy Bundle Lifecycle

How a rule change reaches every enforcement point without becoming an outage.

Editable source SVG draw.io All views
Author Rego in Git Review 2 approvers Build and Test opa build · conftest Dry Run last 24 h traffic Sign and Publish OCI bundle Distribute p95 ≤ 5 min Enforce and Observe decision logs Policy Bundle versioned · signed merge request approved bundle candidate impact report signed artifact at every cluster telemetry back Policy Bundle Lifecycle — Policy as Reviewed Data Application we own Decision point Security / platform Interface / broker A bundle that would have denied more than 2% of the last 24 h requires an explicit override. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Policy is Rego in Git, promoted through the same review as application code, with two approvers
  • Every bundle is dry-run against the last 24 hours of admission traffic before it enforces
  • A bundle that would have denied more than 2% of that traffic requires an explicit override

Guarantees

  • A distinct bundle per environment, with a build-time check that the production bundle is never weaker than staging's
  • Every rule supports a dry-run mode that records what it would have decided
  • Bundle change to full propagation p95 ≤ 5 minutes; maximum tolerated cached staleness 30 minutes

Assumptions

  • 24 hours of admission traffic is retained in ClickHouse specifically to make the dry-run possible
  • 'Never weaker' is checked as rule-set containment, which catches removal but not every weakening of a predicate — a stated limitation
◀  Evidence Plane Pipeline All views Data Architecture and Storage Zones  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises09-policy-bundle-lifecycle