Policy gates

Vetrix's policy subsystem has two layers:

1. .vetrix/tooling.yml policy: block — a declarative severity gate authored in the Configure wizard. This page covers it.
2. Instance-level Rego — operators override defaults across the whole instance via /admin/security/policy. That page ships with the OPA backend.

Shape

policy:
  merge:
    block_on:
      - category: secret
        verified: true
      - category: sca
        severity: critical
        direct: true
  deploy:
    require:
      - sbom
      - image-signed
    block_on:
      - category: any
        severity: critical
        baseline: false

Each block_on entry is an AND of its fields. Multiple entries compose with OR — any match is a block.

Merge gate rules

The merge gate is evaluated when a PR is updated. It receives:

• The set of findings on the PR head commit.
• The set of findings on the target branch at merge-base.
• The baseline file (if any).
• The SBOM for the PR head commit (if emitted).
• The verification attestations attached to the run.

block_on keys:

Key	Semantics
category	secret, sca, sast, iac, standards, any
severity	critical, high, medium, low, info — floor, not exact
verified	only match findings with properties.verified=true
direct	SCA only: only match direct dependencies
baseline	false matches only non-baselined; true matches only baselined
new_only	match only findings absent from the target branch

Deploy gate rules

Deploy gate runs when a workflow run attempts to deploy to a protected environment. In addition to the merge-gate keys, it accepts:

Key	Semantics
require: sbom	deploy blocked if no CycloneDX SBOM is attached
require: image-signed	deploy blocked if the image has no signature attestation

Evaluation order

1. Instance-default Rego (when OPA backend is wired).
2. Per-repo .vetrix/security.rego (composed with — not replacing — the instance default).
3. .vetrix/tooling.yml policy: block.

A block at any layer stops the gate. The page renders the blocking rule in the PR status so reviewers can resolve it.

Writing clean rules

• Start with warn enforcement; promote to block once the policy is producing the right shape.
• Reserve category: any for the deploy path — on merge it over-fires.
• Use baseline: false to let grandfathered debt through without disabling the gate entirely.
• Pair verified: true on secret with block — unverified secrets are by definition noisy, and blocking them trains reviewers to ignore the gate.