# Welcome to the Policy as Code Forum! Get started here **URL:** \ **Category:** Project Discussions\ **Tags:** policy-as-code\ **Created:** [May 2, 2024, 2:49pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265 "2024-05-02T14:49:08Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 17, 2024, 3:20pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/21 "2024-06-17T15:20:47Z")
The webinar will be a available on demand for a year for those who miss the opportunity. I will also be using some of the content (demos) in other communication channels as well. ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 18, 2024, 9:26pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/22 "2024-06-18T21:26:20Z")
- Ensure that a playbook does not touch certain files (ie: /etc/sudoers): [ansible-policybook-examples/policy/infra/common/banned\_file\_modifications.yml at main · ansible/ansible-policybook-examples · GitHub](https://github.com/ansible/ansible-policybook-examples/blob/main/policy/infra/common/banned_file_modifications.yml) - Ensure that a playbook does not open certain firewall ports: [ansible-policybook-examples/policy/security/common/check\_firewall.yml at main · ansible/ansible-policybook-examples · GitHub](https://github.com/ansible/ansible-policybook-examples/blob/main/policy/security/common/check_firewall.yml) For variable use cases - see is/is not defined in [ansible-policy/ansible\_policy/policybook/README.md at main · ansible/ansible-policy · GitHub](https://github.com/ansible/ansible-policy/blob/main/ansible_policy/policybook/README.md) ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 18, 2024, 9:29pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/23 "2024-06-18T21:29:10Z")
If you missed todays webinar about the new ansible-policy CLI tooling never fear! It’s available on demand - [Automating Policy as Code for consistency and compliance](https://www.redhat.com/en/events/webinar/automating-policy-as-code-for-consistency-and-compliance) If you just want to play with the code, then checkout: [GitHub - ansible/ansible-policy: ansible-policy is a prototype implementation which allows us to define and set constraints to the Ansible project in OPA Rego language.](https://github.com/ansible/ansible-policy) and [GitHub - ansible/ansible-policybook-examples](https://github.com/ansible/ansible-policybook-examples) ^^^ Really looking forward to getting some PRs for more examples You can also check out the recorded demo on [Linkedin](https://www.linkedin.com/posts/ffirg_want-to-see-the-latest-ansible-policy-as-code-activity-7208947744005091328-dIjd?utm_source=share&utm_medium=member_desktop) Enjoy! ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [June 19, 2024, 1:53am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/24 "2024-06-19T01:53:20Z")
I attended the webinar from earlier today, and I must say I’m much more comfortable with the direction this is taking than [I was last week](http://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/17). This isn’t really a summary of the webinar (like @gwmngilfen hoped for) as much as my impression of what I heard and saw. Furthermore, this is still early days, so how PoC eventually integrates into workflows etc. will undoubtedly evolve. So with those caveats, here’s a first draft of the PoC _elevator speech_ I’ll eventually share with my team. It’ll probably leave out details that @Phil_Griffiths and friends might consider crucial distinguishing deliverables, but I absorb new stuff in multiple passes, and I’ve only had my first pass at any concrete details. Okay, enough qualifiers. Imagine “`ansible-lint` for policy”. Like `ansible-lint`, you can run `ansible-policy` on individual files (playbooks certainly; I don’t know about individual task files) or on a whole project. And the console output resembles that of `ansible-lint`. Beyond that, though, the contrasts between them helps clarify what `ansible-policy` is all about. The rules of `ansible-lint` are implemented in python; you tweak config file(s) to choose which of those rules are in- or out-of-play and to what degree. In contrast, Policy as per `ansible-policy` is defined in `YAML` files; no python required. People who work with Ansible `YAML` assets should be able to read and write their own policy definitions. Individual sets of policy files can be created, shared, mixed, matched, and tweaked to fit an organization’s requirements. They can be managed as sets of small files in logical subdirectories; you don’t have to compile or combine them into a “black box policy blob”. I think of `ansible-policy` as picking up where `ansible-lint` leaves off. So for example where `ansible-lint` encourages you to set an `owner:` and `group:` when using the `ansible.builtin.template` module, your locally-written policy for `ansible.builtin.template` could check that the _values_ for `owner:` or `group:` come from an approved list of user and group ids. Similarly for pretty much any values in whatever context you care to specify, you can put some constraints on them. I don’t feel I have enough exposure to it yet to say anything more specific, but that’s the perspective I’ve taken away from today’s webinar. See the examples at [GitHub - ansible/ansible-policybook-examples](https://github.com/ansible/ansible-policybook-examples) for, well, examples. It should be fun to see how well this description holds up over time as the tool and associated technology matures. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [June 19, 2024, 5:22am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/25 "2024-06-19T05:22:10Z")
Thank you Todd, that clears up some confusion I had about this initially. I didn’t attend today’s seminar, so I appreciate your write-up. ---
**Author:** ![gwmngilfen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gwmngilfen/32/6_2.png) [@gwmngilfen](https://forum.ansible.com/u/gwmngilfen)\ **Post date:** [June 19, 2024, 8:39am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/26 "2024-06-19T08:39:56Z")
> [@Phil\_Griffiths](#): > > ^^^ Really looking forward to getting some PRs for more examples You should feed them into InstructLab and let the generative AI write some more 😛 ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 19, 2024, 9:30am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/27 "2024-06-19T09:30:32Z")
This is the plan. We’re working with IBM Research to do just that. Results are already encouraging! ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 19, 2024, 9:35am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/28 "2024-06-19T09:35:11Z")
Hey Todd! Thanks for attending and the excellent write up. Right now, focussing on content creation this does very much align with an ansible-lint way of thinking. When we get into the platform functionality this will become so very much more. ---
**Author:** ![kmf](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kmf/32/490_2.png) [@kmf](https://forum.ansible.com/u/kmf)\ **Post date:** [June 19, 2024, 11:03am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/29 "2024-06-19T11:03:52Z")
Had a look at the Webinar, some thoughts. It doesn’t feel like it’s part of the Ansible™ eco system. There is some workflow issues with the way that you would want to implement policies, I like the idea that it can check code, but can that policy be run agains Infra? ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [June 19, 2024, 11:46am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/30 "2024-06-19T11:46:53Z")
Hi Karl. The ‘grand plan’ is to have policy content as part of the overall content ecosystem. Hopefully it can become an extension to collections. Right now the tooling is only designed to show you the art of the possible and get feedback on use cases and policies. The next engineering efforts are focussed around your sort of infra needs where this needs to be part of a SDL ‘workflow’ with suitable integration points. As well as the tooling, we’re aiming to make this an end to end experience where when creating automation content this becomes part of the flow. Thanks for the comments! Phil. ---
**Author:** ![akira6592](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/akira6592/32/222_2.png) [@akira6592](https://forum.ansible.com/u/akira6592)\ **Post date:** [June 19, 2024, 11:55am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/31 "2024-06-19T11:55:11Z")
Thank you for the inforomation! It helped me understand as I had wondered what the difference was between this and ansible-lint. ---
**Author:** ![lucab\_it](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lucab_it/32/320_2.png) [@lucab\_it](https://forum.ansible.com/u/lucab_it)\ **Post date:** [June 19, 2024, 1:34pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/32 "2024-06-19T13:34:13Z")
I just created a video on how to install ansible-policy and a simple rulebook about Policy as Code on my blog: [Project Policy Validation with OPA and ansible-policy - Ansible Pilot](https://www.ansiblepilot.com/articles/project-policy-validation-with-opa-and-ansible-policy/) ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [June 19, 2024, 5:05pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/33 "2024-06-19T17:05:05Z")
Now that I have a better understanding of what `ansible-policy`’s intended function is, I really like where it’s headed. It definitely will need a GitHub Action similar to the one for `ansible-lint`. ---
**Author:** ![ericcames](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ericcames/32/4309_2.png) [@ericcames](https://forum.ansible.com/u/ericcames)\ **Post date:** [July 25, 2024, 7:35pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/34 "2024-07-25T19:35:08Z")
Is this the correct place for customer to provide their feedback on Policy as Code? Thank you in advance for the feedback! ---
**Author:** ![CindyRuss](https://avatars.discourse-cdn.com/v4/letter/c/4bbf92/32.png) [@CindyRuss](https://forum.ansible.com/u/CindyRuss)\ **Post date:** [July 25, 2024, 8:00pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/35 "2024-07-25T20:00:10Z")
Yes it is! Please share your thoughts here in this thread. ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [July 26, 2024, 2:09pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/36 "2024-07-26T14:09:27Z")
My work group runs a clustered application that the vendor provides as stand-alone RPMs. You can install multiple versions side-by-side, and activate whichever one is supposed to be live. Saves a lot of time on upgrades, etc. The part relevant to “Policy as Code” is the internal discussion we’re currently having about how many and/or which RPMs to leave installed vs. to remove, and likewise policing our local cache of RPM files we’ve downloaded from the vendor. I’m not sure what the final decision on this will be, but it smells a lot more like policy than procedure. That is, uninstalling installed RPMs and removing RPM files from a cache is easy. (Too easy, as we’ve found out. Don’t ask!) Choosing the right RPMs to remove would seem to me to be in the “Policy as Code” wheelhouse. I’m still trying to wrap my head around how PaC intersects with automation, so specific examples like this help to clarify it. Not looking for a specific answer to this need, but rather tossing it into the idea pool to be considered as things evolve in this space. ---
**Author:** ![gwmngilfen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gwmngilfen/32/6_2.png) [@gwmngilfen](https://forum.ansible.com/u/gwmngilfen)\ **Post date:** [July 29, 2024, 8:21am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/37 "2024-07-29T08:21:35Z")
We probably don’t want 100 examples in this single thread 🙂 We’ve created the #policy-as-code tag (which anyone can follow for notifications), and #Project Discussions seems the right venue for such discussion. So new topics in #Project Discussions with that tag are the way to go. @CindyRuss @Phil_Griffiths if it’s useful to you for wider circulation, you can use this link for people to create a new topic in the right way (good for docs/socials!) [http://forum.ansible.com/new-topic?title=Policy-as-code%20Topic&body=your%20feedback%20here&category=project&tags=policy-as-code](http://forum.ansible.com/new-topic?title=Policy-as-code%20Topic&body=your%20feedback%20here&category=project&tags=policy-as-code) Give it a try! ---
**Author:** ![Phil\_Griffiths](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/phil_griffiths/32/2779_2.png) [@Phil\_Griffiths](https://forum.ansible.com/u/Phil_Griffiths)\ **Post date:** [July 29, 2024, 9:09am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/38 "2024-07-29T09:09:48Z")
Hi Todd. The key here would be what the rule(s) would be that would dictate the conditions for any change. How do you decide when to remove/update etc? If you are using yum/dnf to do the operations then it would probably be based around some metadata that could be used in those modules. Otherwise, you’d be calling to get approval or validation from some ‘external’ system. Have you looked at the many examples in [GitHub - ansible/ansible-policybook-examples](https://github.com/ansible/ansible-policybook-examples) ? They should give you some ideas. Probably [ansible-policybook-examples/policy/infra/os/rhel/check\_pkg.yml at main · ansible/ansible-policybook-examples · GitHub](https://github.com/ansible/ansible-policybook-examples/blob/main/policy/infra/os/rhel/check_pkg.yml) is the base to work from for this type of example. Phil. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [December 22, 2025, 10:22pm UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/39 "2025-12-22T22:22:24Z")
> [@Phil\_Griffiths](#): > > If you missed todays webinar about the new ansible-policy CLI tooling never fear! … > > If you just want to play with the code, then checkout: > [GitHub - ansible/ansible-policy: ansible-policy is a prototype implementation which allows us to define and set constraints to the Ansible project in OPA Rego language.](https://github.com/ansible/ansible-policy) and > [GitHub - ansible/ansible-policybook-examples](https://github.com/ansible/ansible-policybook-examples) @Phil_Griffiths Hi Phil! Just wanted to ask if there was any news on `ansible-policy`’s development? (the tool specifically) Been recently testing the AAP 2.6 integration with OPA, which got me interested in revisiting `ansible-policy`, but was disappointed to see so little development for it over the last year and a half. ---
**Author:** ![ffirg](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ffirg/32/10029_2.png) [@ffirg](https://forum.ansible.com/u/ffirg)\ **Post date:** [December 23, 2025, 9:13am UTC](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265/40 "2025-12-23T09:13:54Z")
Hi Caleb Thanks for reaching out! No, there’s no new development around ansible-policy. We decided not to implement this into the platform for the AAP policy enforcement feature. Phil. [Previous page](https://forum.ansible.com/t/welcome-to-the-policy-as-code-forum-get-started-here/5265.md?page=1)