Custom Policies¶

VirtualSutra AI can evaluate your own security rules, written in Rego (the Open Policy Agent (OPA) policy language), against every finding produced by an inspection run. Use this to encode organization-specific rules that don't map to a built-in check (e.g. "flag anything tagged env=prod without an owner tag").

Rego is the single custom-policy language. Custom Checks are the complementary mechanism: they register a check definition and map it to a specific compliance control ID so the finding counts toward a framework's score. Use a Custom Policy to express the rule, and a Custom Check when you also need the compliance-control mapping.

Earlier releases offered a JSONPath match-expression field on Custom Checks. It was never evaluated and has been removed - see the note on the Compliance page.

Where to find it¶

Go to Settings > Custom Policies. The page lists every policy defined for your organization: name, severity, enabled/disabled state, and the compliance controls it maps to.

Writing a policy¶

A policy is a single Rego file with two hard requirements:

Each finding is evaluated individually and is available to your policy as input. A minimal example that flags any critical finding missing an owner tag:

package vsutra.policy

deny[msg] {
    input.severity == "critical"
    not input.tags.owner
    msg := "Critical finding has no owner tag"
}

Fill in:

Click Save. The server compiles and syntax-checks your Rego before saving; a syntax error is returned inline and the policy is not saved until it's fixed.

Note: If the compliance-agent image doesn't have the OPA binary available (custom/self-hosted deployments only), policy validation degrades gracefully: the policy is still saved, but flagged with a validation warning until it can be checked. This does not apply to the default VirtualSutra images, which always ship OPA.

What your policy can and can't do¶

For safety, policy evaluation runs in a locked-down sandbox:

• Each evaluation gets a fresh, isolated temp directory, so no state persists between runs.
• Network and filesystem primitives are disabled: http.send, net.lookup_ip_addr, and opa.runtime are stripped from the policy's capabilities before it runs. A policy cannot make outbound requests or read local files, even if it tries.
• Evaluation is capped at 5 seconds and a 256KB input size per finding.

Editing and disabling¶

Click an existing policy to edit its Rego source, severity, or mappings. The server re-validates and re-compiles on every save. Toggle Enabled off to stop evaluating a policy without deleting it (useful while iterating). Delete removes it permanently.