Policy & Enforcement

Decide what installs and what gets refused — CVSS/EPSS gates, license rules, freshness, geo/IP, monitor mode, fail-closed, and owner routing.

Known-malicious blocks Why Chainsaw blocks known-malicious package installs at the proxy before policy evaluation, what data backs the gate, and the supported false-positive path. Reference 5 minutes Operators How to Manage Policy Precedence and Exception Workflows Understand first-match-wins evaluation, order policies by precedence, create time-bound exceptions, and balance security with developer productivity. Advanced 25 minutes Security Engineers / DevOps Engineers How to Block Vulnerable Packages Using CVSS and EPSS Score Policies Create policies with vulnerability conditions, set CVSS/EPSS thresholds, and choose between block and quarantine enforcement modes. Intermediate 20 minutes Security Engineers How to Enforce License Compliance Across Your Supply Chain Set up SPDX license allowlists and blocklists in policies, monitor license coverage from the dashboard, and handle unknown licenses. Intermediate 20 minutes Security Engineers / Compliance Teams How to Set Up Release Freshness Guards to Block New Packages Configure package age policies to block packages younger than N days, protecting against attacks that exploit freshly published malicious versions. Intermediate 15 minutes Security Engineers How to Use Country and IP-Based Access Policies Configure GeoIP-based policies to restrict package access by country, and create IP allowlists/blocklists for network-level access control. Advanced 20 minutes Security Engineers / Compliance Teams How to Enable Monitoring for a Single Policy Use per-policy Monitor mode to record audit-only matches on one policy without disabling enforcement on the rest of your policy stack. Intermediate 10 minutes Security Engineers / Platform Engineers How to Enable Checksum Fail-Closed Enforcement Block silently swapped upstream packages by switching CHAINSAW_CHECKSUM_MODE from log to quarantine or block. Advanced 15 minutes Platform Engineers / Security Engineers How to Tune Risk Signal Weights via /settings/risk-weights Override the default weights of every supply-chain signal that feeds the trust score. When the defaults don't match your org's risk model, tune them in the settings UI without writing custom policy. Advanced 20 minutes Security Engineers / Risk Officers How to Route Violations to CODEOWNERS-Resolved Owners with ActionNotifyOwner Fire a notification, not a block — when a policy with `ActionNotifyOwner` matches, Chainsaw resolves the manifest's CODEOWNERS team and dispatches via your configured destination map. The minimum-friction way to put accountability on the right team. Intermediate 25 minutes Security Engineers / Engineering Managers Policy DSL Reference (Rego / OPA Authoring Surface) Author custom org-specific rules in Rego against the chainsaw.policy entrypoint: the input fields a rule can read, the decision shape it returns, the supported actions, and which inputs are populated at which enforcement surface. Advanced 30 minutes Security Engineers / Platform Engineers How to Author, Sign, and Load Signed Policy Bundles Ship custom Rego rules as a cosign-signed bundle that the server verifies at load — author, sign, verify-at-load, promote — with the same signed bundle enforced at PR, install, K8s admission, and runtime, and the bundle digest stamped on each policy decision and carried into the audit trail. Advanced 30 minutes Platform Engineers / Security Engineers YAML Conditions vs the Rego Policy DSL Chainsaw has two policy surfaces — the built-in YAML / dashboard conditions and the signed Rego DSL. When to reach for each, and how they relate. Intermediate 10 minutes Security Engineers / Platform Engineers How to Refuse Installs When a Required Signal Could Not Be Evaluated Turn on the optional fail-closed coverage gate: declare the data sources that must be evaluable, measure in warn mode, then refuse instead of allowing unchecked. Off by default. Advanced 30 minutes Platform Engineers / Security Engineers in regulated environments

Policies are how Chainsaw turns “we saw a risky package” into “the install was refused.” Start with the policy model (precedence and exceptions), add your first high-signal gate, then move from authoring rules to operating them safely with monitor mode and tuning.

Roll out without breaking builds. Every policy can run in monitor mode first — it records what would have blocked without refusing the install. Enable enforcement only once the would-block volume looks right.

Policy DSL & signed bundles

Beyond the built-in conditions, Chainsaw lets you author custom org-specific rules in Rego / OPA and ship them as a signed bundle — the product’s policy-as-code surface, enforced at every surface (PR, proxy, publish, K8s admission, runtime, promote).

Policy DSL Reference (Rego / OPA Authoring Surface) — the chainsaw.policy entrypoint, the input fields a rule can read, the decision shape, and worked examples
How to Author, Sign, and Load Signed Policy Bundles — author → cosign sign → verify-at-load → promote, with the bundle digest on every signed audit row
YAML Conditions vs the Rego Policy DSL — the two policy surfaces, when to use which, and how they relate

When a signal could not be evaluated

By default, a signal Chainsaw could not evaluate — feed stale, upstream down, no artifact bytes — is recorded and the install proceeds. Chainsaw does not fail closed as shipped. Regulated and air-gapped deployments can opt into the opposite behaviour for the data sources they name.

How to Refuse Installs When a Required Signal Could Not Be Evaluated — the optional fail-closed coverage gate: the eight source names, what each surface can honestly attest, and why you should start in warn. Off by default; not wired into CI.

Where to next

The what you block comes from Threat Detection (the conditions) and Provenance & SBOM. Watch policy outcomes in Monitoring & Compliance.