Policy-as-code with Rego

Pull-gate policies normally pick from fixed criteria (license, signature, scan, SBOM). A policy of type rego adds your own rule, written in Rego, on top of those criteria. The same policy gates downloads and promotions.

Contract

A policy is one Rego module in the package orbital.policy:

Rule	Meaning
allow	Boolean, defaults to false. Must be true to permit.
deny	Set of human-readable reasons. Any member blocks.

The decision is allow only when allow is true and deny is empty.

Input document

{
  "artifact": {
    "id": "…", "path": "org/example/app/1.0.0/app-1.0.0.jar", "sha256": "…",
    "uploaded_at": "2026-01-01T00:00:00Z", "license": "Apache-2.0",
    "has_sbom": true, "has_signature": false, "max_severity": "high"
  },
  "repo": { "id": "…" },
  "project": { "id": "…" },
  "principal": { "kind": "user", "id": "…", "email": "dev@example.com" }
}

Build-info is not part of the input yet.

Limits and failure behaviour

• Evaluation is fail-closed: a compile error, runtime error, timeout or oversized input blocks the request, with the error as the reason.
• Timeout 250 ms per evaluation; module at most 64 KiB; input at most 1 MiB.
• http.send, net.lookup_ip_addr, opa.runtime, rego.metadata.* and time.now_ns are removed, so a dry-run always matches the real gate.

Examples

Signed and free of high/critical vulnerabilities:

package orbital.policy

default allow = false

allow if {
  input.artifact.has_signature
  not input.artifact.max_severity in {"high", "critical"}
}

deny contains "artifact is not signed" if not input.artifact.has_signature

deny contains "high or critical vulnerability" if input.artifact.max_severity in {"high", "critical"}

Require an SBOM:

package orbital.policy

default allow = false

allow if input.artifact.has_sbom

deny contains "no SBOM attached" if not input.artifact.has_sbom

Trying a policy

In Admin → Pull-gate, the Rego editor has a Test run button that evaluates the unsaved policy against an example artifact (or your own input document) via POST /api/admin/pull-gate/rego/test. Compile errors return 400. The existing pull-gate simulate preview shows what a saved policy would do to real artifacts without blocking anything.

Promotions

Rego policies scoped to the target repository or project are evaluated for every artifact in a promotion. A denial fails the promotion with HTTP 409 rego_policy_block.