Policies

13 tutorials in this category.

01 How to Manage Policy Precedence and Exception Workflows Understand first-match-wins evaluation, order policies by precedence, create time-bound exceptions, and balance security with developer productivity. Advanced 25 minutes Security Engineers / DevOps Engineers 01 How to Use Billy to Investigate Packages and Draft Policies Ask Billy natural language questions about your package consumption, vulnerabilities, and policy gaps, then review and approve Billy's policy proposals. Beginner 15 minutes All Personas 02 How to Block Vulnerable Packages Using CVSS and EPSS Score Policies Create policies with vulnerability conditions, set CVSS/EPSS thresholds, and choose between block and quarantine enforcement modes. Intermediate 20 minutes Security Engineers 03 How to Enforce License Compliance Across Your Supply Chain Set up SPDX license allowlists and blocklists in policies, monitor license coverage from the dashboard, and handle unknown licenses. Intermediate 20 minutes Security Engineers / Compliance Teams 04 How to Review and Manage Quarantined Packages Understand the quarantine workflow, review flagged packages, approve or reject quarantined items, and transition from quarantine to blocking policies. Intermediate 15 minutes Security Engineers 04 How to Set Up Release Freshness Guards to Block New Packages Configure package age policies to block packages younger than N days, protecting against attacks that exploit freshly published malicious versions. Intermediate 15 minutes Security Engineers 05 How to Use Country and IP-Based Access Policies Configure GeoIP-based policies to restrict package access by country, and create IP allowlists/blocklists for network-level access control. Advanced 20 minutes Security Engineers / Compliance Teams 06 How to Enable Monitoring for a Single Policy Use per-policy Monitor mode to record audit-only matches on one policy without disabling enforcement on the rest of your policy stack. Intermediate 10 minutes Security Engineers / Platform Engineers 09 How to Route Violations to CODEOWNERS-Resolved Owners with ActionNotifyOwner Fire a notification, not a block — when a policy with `ActionNotifyOwner` matches, Chainsaw resolves the manifest's CODEOWNERS team and dispatches via your configured destination map. The minimum-friction way to put accountability on the right team. Intermediate 25 minutes Security Engineers / Engineering Managers 10 Policy DSL Reference (Rego / OPA Authoring Surface) Author custom org-specific rules in Rego against the chainsaw.policy entrypoint: the input fields a rule can read, the decision shape it returns, the supported actions, and which inputs are populated at which enforcement surface. Advanced 30 minutes Security Engineers / Platform Engineers 11 How to Author, Sign, and Load Signed Policy Bundles Ship custom Rego rules as a cosign-signed bundle that the server verifies at load — author, sign, verify-at-load, promote — with the same signed bundle enforced at PR, install, K8s admission, and runtime, and the bundle digest stamped on each policy decision and carried into the audit trail. Advanced 30 minutes Platform Engineers / Security Engineers 11 How to Use Trust Scores to Assess Package Risk Understand the 0-100 composite trust score breakdown, filter by trust score, and build policies around package trust levels. Intermediate 20 minutes Security Engineers / Compliance Teams 12 YAML Conditions vs the Rego Policy DSL Chainsaw has two policy surfaces — the built-in YAML / dashboard conditions and the signed Rego DSL. When to reach for each, and how they relate. Intermediate 10 minutes Security Engineers / Platform Engineers