IaC Policy Gates

Without it, each file is evaluated on its own and the input is that file's document. With --combine, all files are merged into one evaluation where the input is an array of elements carrying a path and the file's contents, so rules must iterate rather than address fields directly.

Usually you do not gate it here. When the control's subject is missing from this plan, either constrain the module input so it becomes visible, or re-home the control where the subject exists. Approximating it is worse than not enforcing it.

Compare both sides of the diff. Deny when change.after's retention is lower than change.before's, so an already sub-standard database can be edited for unrelated reasons but never made worse. Creates have no before, so apply the absolute minimum.

Read the policy check output first: a failure across every workspace at once points at the policy set or its inputs, not at anyone's change. Then reproduce offline by downloading a failed run's mock data and evaluating the policy locally.

Check three layers in order: the engine never loaded the file (wrong custom-rule path, or a package namespace the scan does not include), the required metadata is missing so the rule is not registered or graded, and the Rego body is simply undefined — in Rego undefined yields no result, not a failure.

A ticket records that someone said they fixed it. Proof is the same rule, re-run over current state, no longer returning that resource — shown alongside the earlier run that did return it.

Collect two sources, not one: every inline skip annotation in the source, and every skip-check, skip-path and skip flag in scan configuration and pipeline definitions. Then age each one with git history and the scan's skipped-checks output.