Infrastructure Policies

Infrastructure Policy v1 lets an operator decide whether a protected effect may run. It evaluates the actual normalized operation at the Rust authority boundary, where the executable, target, effect class, and approved evidence are known. A policy complements Process and Artifact Policies; it does not replace their capability limits.

Check and explain a policy

Keep the policy bundle outside workflow source and validate it before activation:

woml policy check ./production-policy.json
woml policy explain deploy.woml --policy ./production-policy.json
woml policy explain deploy.woml --policy ./production-policy.json --step applyPlan
woml check deploy.woml --policy ./production-policy.json

policy explain reports what static analysis can prove. Dynamic arguments, targets, and evidence may remain unknown until runtime; an explanation is never a grant. The final decision is made immediately before the protected effect.

Activate with reviewed authority

woml run deploy.woml --policy ./production-policy.json --process-policy ./process-policy.json

For an incident, a separate emergency-deny overlay may only remove permission:

woml run deploy.woml --policy ./production-policy.json --emergency-deny ./incident-stop.json

Policy files can be signed and checked against operator trust configuration. Do not let a workflow edit its own policy or trust files. woml get <run-id> shows bounded decision evidence without raw arguments, secrets, payloads, or artifact bodies.

Know the evidence boundary

WOML can verify its own facts, such as an approved artifact digest, current lock lease, and authenticated reviewer role. It cannot prove that arbitrary Terraform, Kubernetes, SQL, or AI-generated content is semantically safe just because that content passed through a workflow. Review those effects and use an appropriate external verifier.

Related documentation

• Secure Process Execution
• Rich Plan Approvals
• Locks and Leases