Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"width":2243,"height":1525,"updated":"2026-03-12T05:35:40.110Z"}
34 changes: 24 additions & 10 deletions src/pages/docs/platform-hub/policies/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,23 @@ To get started, navigate to the Platform Hub inside of your Octopus instance and
![A empty policies list in the Platform Hub](/docs/img/platform-hub/policies/policies-getting-started.png)
:::

### 2. Give your policy a name
### 2. Select a starter policy

You will be presented with the Create Policy modal. You can then set the name of your policy. Octopus will generate a valid slug for your policy based on the name you provide. You can edit this slug before clicking the `Create` button.
You will be presented with the Create Policy modal. The first step is to select a starter policy to base your new policy on. To continue click the `Next` button.

:::figure
![A modal to select a starter policy](/docs/img/platform-hub/policies/policies-create-starter-modal.png)
:::

:::div{.hint}

- If you want to start with the most basic policy, choose Create Blank Policy.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- If you want to start with the most basic policy, choose Create Blank Policy.
If you want to start with the most basic policy, choose Create Blank Policy.

@shaun-od did you mean to add this as a bullet point?


:::

### 3. Give your policy a name

You can then set the name of your policy. Octopus will generate a valid slug for your policy based on the name you provide. You can edit this slug before clicking the `Done` button.

:::figure
![A modal to create a new policy](/docs/img/platform-hub/policies/policies-create-modal.png)
Expand All @@ -71,7 +85,7 @@ You will be presented with the Create Policy modal. You can then set the name of

:::

### 3. Update your policy details
### 4. Update your policy details

This will create the Policy file in your Platform Hub repository and then take you to the edit Policy page, where you can update the following details for your policy.

Expand All @@ -97,7 +111,7 @@ See

:::

### 4. Define the policy scope
### 5. Define the policy scope

You’ll now need to define the policy's scope, as Rego in the OCL file. Octopus will provide data about your deployments to the policy engine to use during evaluation. When you are writing your Rego code for scoping or conditions, this input data is available under the value ```input.VALUE```. This scope section of the policy defines the package name, which must match the underlying .ocl file name the policy is stored in. By default, the policy evaluates to false. The scope will evaluate to true if the deployment is going to the Production environment, for the ACME project, and in the Default space - all three conditions must be true at the same time.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
You’ll now need to define the policy's scope, as Rego in the OCL file. Octopus will provide data about your deployments to the policy engine to use during evaluation. When you are writing your Rego code for scoping or conditions, this input data is available under the value ```input.VALUE```. This scope section of the policy defines the package name, which must match the underlying .ocl file name the policy is stored in. By default, the policy evaluates to false. The scope will evaluate to true if the deployment is going to the Production environment, for the ACME project, and in the Default space - all three conditions must be true at the same time.
You’ll now need to define the policy's scope, as Rego. Octopus will provide data about your deployments to the policy engine to use during evaluation. When you are writing your Rego code for scoping or conditions, this input data is available under the value ```input.VALUE```. This scope section of the policy defines the package name, which must match the underlying .ocl file name the policy is stored in. By default, the policy evaluates to false. The scope will evaluate to true if the deployment is going to the Production environment, for the ACME project, and in the Default space - all three conditions must be true at the same time.

@shaun-od we should drop the mention of the OCL file because all policy changes are being made in the UI and not as code.


Expand Down Expand Up @@ -135,7 +149,7 @@ evaluate := true if {
}
```

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@shaun-od do we need to callout that ēvaluate is a required keyword and cannot be renamed?

For conditions we call out the following:
You cannot rename result, it must be called result.

### 5. Define the policy conditions
### 6. Define the policy conditions

After defining your scope, you must specify the policy rules. These rules are written in Rego. Octopus will check the results of your Rego code to determine if a deployment complies with the policy. The result should contain a composite value with the properties **allowed** and an optional **reason** and **action**. In this example, we will set the default rule result to be non-compliant. Any deployment that does not meet the policy rules will be prevented from executing. This conditions section of the policy defines the package name, which must match the slug for your policy. By default, the policy evaluates to false. The condition will evaluate to true if the deployment contains the required steps.

Expand All @@ -158,7 +172,7 @@ Full details on the data available for policy scoping and conditions can be foun

<br>

### 6. Check for a deployment step
### 7. Check for a deployment step

After you’ve set the default state, you’ll need to define the policy rules that will update the **result** state to be true so the deployment can execute. In this example, the deployment must contain at least one manual intervention step. We can do this by checking the step.ActionType is “Octopus.Manual”

Expand All @@ -179,15 +193,15 @@ result := {"allowed": true} if {

After your policy details have been finalized you will need to commit, publish and activate your policy for it to be available for evaluation.

### 7. Saving a Policy
### 8. Saving a Policy

Once you've finished making changes to your policy you can commit them to save the changes to your Git repository. You can either **Commit** with a description or quick commit without one.

:::figure
![The commit experience for a policy](/docs/img/platform-hub/policies/policies-commit-experience.png)
:::

### 8. Publishing a Policy
### 9. Publishing a Policy

Once you've made your changes, you will have to publish the policy to reflect the changes you've made. You will have three options to choose from when publishing changes:

Expand All @@ -203,7 +217,7 @@ The first time you publish a policy you can only publish a major version
![Publish experience for a policy](/docs/img/platform-hub/policies/policies-publishing.png)
:::

### 9. Activating a policy
### 10. Activating a policy

You must activate the policy before it can be evaluated. Policies can be deactivated after they are activated to stop a policy from being evaluated.

Expand All @@ -215,7 +229,7 @@ Activation settings can be updated anytime, from the Versions tab on the edit po
![Activation status for a policy](/docs/img/platform-hub/policies/policies-activation.png)
:::

### 10. Finalize and test your policy
### 11. Finalize and test your policy

You’ve now defined a basic policy to ensure a manual intervention step is present when deploying to any environment. You can test this policy by customizing the values in the scope block, and then deploying to an environment. If you choose not to include the manual intervention step in your process, you will see errors in the task log and project dashboards when you try to run the deployment. All policy evaluations will appear in the Audit log (**Configuration** → **Audit**) with the “Compliance Policy Evaluated” event group filter applied. Audit logs and Server Tasks will only appear for deployments within the policy's scope.

Expand Down
Loading