Skip to content

Commit f3b7154

Browse files
authored
Edits to Associating policy with AAP resources for clarity (#20)
1 parent 585b3ab commit f3b7154

1 file changed

Lines changed: 10 additions & 9 deletions

File tree

docs/Associating policy with AAP resources.md

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -33,25 +33,27 @@ allowed := {
3333
1. **Package Declaration**: Defines the namespace for your policy
3434
2. **Rules**: Define the policy logic and return a decision object
3535

36+
Note that these components comprise the OPA policy name, which is formatted as `{package}/{rule}`. You will enter the OPA policy name when configuring enforcement points.
37+
3638
## Associating Policies with AAP Resources
3739

3840
### Available Enforcement Points
3941

40-
You can associate policies with the following AAP resources:
42+
You can create an enforcement point by associating a policy with the following AAP resources:
4143

42-
1. **Organization Level**
44+
1. **Organizations**
4345
- Affects all job templates within an Organization
4446
- Provides broad control over automation within organizational boundaries
4547

46-
2. **Inventory Level**
48+
2. **Inventories**
4749
- Affects all jobs using a specified Inventory
4850
- Controls access to specific infrastructure resources
4951

50-
3. **Job Template Level**
52+
3. **Job Templates**
5153
- Affects jobs launched from a specific Job Template
5254
- Provides granular control over specific automation tasks
5355

54-
### How to Associate Policies
56+
### How to Associate a Policy with a Resource
5557

5658
#### 1. Job Template Level
5759

@@ -102,15 +104,14 @@ Policy evaluation is integrated into the job lifecycle as a dedicated phase call
102104
3. **Policy Evaluation**:
103105
- AAP sends the collected policies to the configured OPA server for evaluation
104106
- Each policy is evaluated against the job context
105-
- If any policy evaluation:
107+
- The job will be blocked if any policy evaluation:
106108
- Returns `"allowed": false`, or
107109
- Fails to evaluate
108-
The job will be blocked
109110

110111
4. **Job State Transition**:
111112
- If all policies allow the job:
112-
- Job proceeds to playbook execution
113+
- The job proceeds to playbook execution
113114
- If any policy blocks the job:
114-
- Job transitions to "Error" state
115+
- The job transitions to "Error" state
115116
- Playbook execution is prevented
116117
- Error messages from policy violations are recorded

0 commit comments

Comments
 (0)