Creating a Guardrail Policy
Step-by-step guide to creating a guardrail policy in Facets: set severity, scope it to blueprints and resources, and add Rego enforcement code.
A Guardrail Policy in Facets is a set of predefined rules and conditions designed to enforce security, compliance, and operational standards within your Blueprint.
Refer to the Guardrail Policies concept document to learn more about it.
How to Create a Guardrail Policy?
Using prompt
Add POLICY_NAME to PROJECT_NAME from policy.rego, at error severity.or
Using command
# From a template, filling the inputs it exposes
raptor create guardrail-policy POLICY_NAME \
--stack PROJECT_NAME \
--template-id TEMPLATE_ID \
--resource-type RESOURCE_TYPE \
--input KEY=VALUE
# Or writing the Rego yourself
raptor create guardrail-policy POLICY_NAME \
--stack PROJECT_NAME \
--severity ERROR \
--resource-type RESOURCE_TYPE \
--raw-policy-file policy.regoraptor get policy-templates lists the templates on your control plane, and
raptor get policy-templates TEMPLATE_ID -o yaml shows the inputs one expects. The
policy type follows from the flags, so --template-id makes it templated and
--raw-policy-file makes it raw. --stack is required either way.
New to the CLI? Install it first.
- Navigate to Settings > Guardrails. This page displays default templates and lists existing policies.
- To create a new policy, click Create Policy.
- You can either choose to create a policy from scratch or select a Template where the Policy Parameters are pre-defined.
Note: Guardrail templates are predefined policy frameworks designed to help you quickly establish security and compliance controls within your Blueprint. - Enter the Policy Name (mandatory) and Description.
- Select the Severity (mandatory) level: Warning or Error.
- Warning: Flags potential issues, allowing the release to continue while alerting you to areas that may need attention.
- Error: Blocks releases with critical issues, ensuring they are addressed before proceeding to release.
- Select the desired Blueprint (mandatory) and Environment(s).
- Now, select the required Resource Type(s) and Resource(s).
- Enter the Rego Code. Refer to the Open Policy Agent policy language reference to learn how to write the Rego that enforces your policy.
- Click Create.
You have successfully created a Guardrail Policy in Facets.
Before you rely on a policy in a release, you can dry-run it against a resource document from the CLI:
raptor test guardrail-policy POLICY_NAME -f resource.jsonThe file you pass with -f is the resource document the policy runs against, the same shape the Rego reads as input.
How to Clone an Existing Policy?
To clone an existing policy:
- Click the Clone Policy icon under the Actions column beside the policy you wish to clone.
- The Create Policy page will appear with all the fields pre-filled.
- Update the Policy Name and other required fields if needed, then click Create.
You have successfully cloned an existing policy.
Guardrail policies
Guardrail policies in Facets enforce security and compliance on blueprints using Rego, with Warning or Error severity that can gate releases.
Release Approval
Use Facets release approval workflows to enforce governance: define structured approval processes so only reviewed, authorized changes reach production.