> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-ai/use-harness-platform/governance/policy-as-code/using-harness-policy-engine-for-fme.md).

# Policy As Code for FME Feature Flags

Learn how to create, update, and view policies and policy sets for FME feature flags and feature flag definitions.

Harness provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies.

You can create a policy and apply it to FME (Feature Management & Experimentation) feature flags and feature flag definitions in your Account, Org, or Project. Harness supports two FME entity types:

* **FME Feature Flag** — the feature flag itself (name, description, status, owners, tags).
* **FME Feature Flag Definition** — the per-environment definition of a feature flag (treatments, targeting rules, flag sets).

Both entity types are evaluated on the **On Save** trigger, which fires whenever a feature flag or definition is created, updated, deleted, or archived.

For complete documentation on FME policy setup including input payload reference, see [Using Harness Policy As Code with FME](/feature-management-experimentation/management-and-administration/policies.md).

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* [Harness Governance Overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Harness Governance Quickstart](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)
* Policies use the OPA authoring language Rego. For more information, see [OPA Policy Authoring](https://academy.styra.com/courses/opa-rego).

### FME Feature Flag policies <a href="#fme-feature-flag-policies" id="fme-feature-flag-policies"></a>

#### Step 1: Add a policy <a href="#step-1-add-a-policy" id="step-1-add-a-policy"></a>

1. In Harness, go to **Account Settings** → **Policies** → **New Policy**.
2. Enter a **Name** for your policy and click **Apply**.
3. Add your Rego policy in the editor.

   You can write your own Rego policy or use a sample from the **Library** panel. Select the **Library** tab, choose **Entity: FeatureFlag** from the dropdown:

   ![FME Feature Flag sample policies in the Library panel](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-a80a28d72c9d29d61d55ac8d11902adaff428e0d%2Ffme-feature-flag-sample-policies.png?alt=media)

   Harness ships three sample policies for FME feature flags:

   * **FME Feature Flag – Naming Convention:** Ensures that FME feature flag names follow organizational naming conventions.
   * **FME Feature Flag – Required Tags:** Ensures that FME feature flags have required tags for categorization and tracking.
   * **FME Feature Flag – Team Ownership Required:** Ensures that FME feature flags have at least one owner and all owners are teams, not individual users.

   Below are the Rego policies for all three samples.

**Enforce naming conventions**

This policy ensures feature flag names start with `ff_`, contain only lowercase letters, numbers, and underscores, and are between 5 and 100 characters.

```
package fme_feature_flags

deny[msg] {
  not regex.match("^ff_[a-z0-9][a-z0-9_]*$", input.featureFlag.name)
  msg := sprintf("FME Feature Flag name '%s' must start with 'ff_' and contain only lowercase letters, numbers, and underscores", [input.featureFlag.name])
}

deny[msg] {
  count(input.featureFlag.name) < 5
  msg := sprintf("FME Feature Flag name '%s' is too short (minimum 5 characters)", [input.featureFlag.name])
}

deny[msg] {
  count(input.featureFlag.name) > 100
  msg := sprintf("FME Feature Flag name '%s' is too long (maximum 100 characters)", [input.featureFlag.name])
}
```

**Require tags for categorization**

This policy ensures every feature flag has at least one tag and includes required tags for `owner`, `team`, `service`, and `component`.

```
package fme_feature_flags

deny[msg] {
  count(input.featureFlag.tags) == 0
  msg := sprintf("FME Feature Flag '%s' must have at least one tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("owner")
  msg := sprintf("FME Feature Flag '%s' must have an 'owner' tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("team")
  msg := sprintf("FME Feature Flag '%s' must have a 'team' tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("service")
  msg := sprintf("FME Feature Flag '%s' must have a 'service' tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("component")
  msg := sprintf("FME Feature Flag '%s' must have a 'component' tag", [input.featureFlag.name])
}

contains_required_tag(tag_name) {
  input.featureFlag.tags[_] == tag_name
}

warn[msg] {
  input.featureFlag.description == ""
  msg := sprintf("FME Feature Flag '%s' should have a description for better documentation", [input.featureFlag.name])
}
```

**Enforce team ownership**

This policy ensures every feature flag has at least one owner and that all owners are teams rather than individual users.

```
package fme_feature_flags

deny[msg] {
  count(input.entityMetadata.owners) == 0
  msg := sprintf("FME Feature Flag '%s' must have at least one owner", [input.featureFlag.name])
}

deny[msg] {
  some i
  owner := input.entityMetadata.owners[i]
  owner.ownerType == "user"
  owner_name := object.get(owner, "ownerName", owner.ownerId)
  msg := sprintf("FME Feature Flag '%s' has an individual user owner '%s'. Owners must be teams, not individual users", [input.featureFlag.name, owner_name])
}
```

4. Click **Save**.

#### Step 2: Add the policy to a policy set <a href="#step-2-add-the-policy-to-a-policy-set" id="step-2-add-the-policy-to-a-policy-set"></a>

1. Go to **Policies** → **Policy Sets** → **New Policy Set**.
2. Enter a **Name** and optional **Description** for the Policy Set.
3. In **Entity type**, select **FME Feature Flag**.
4. In **On what event should the Policy Set be evaluated**, select **On Save**.
5. Click **Continue**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Existing feature flags are not automatically evaluated against new policies. Policies are applied only when a feature flag is saved (created, updated, deleted, or archived).</p></div>
6. In **Policy evaluation criteria**, click **Add Policy**.
7. In the **Select Policy** dialog, choose the scope (**Project**, **Org**, or **Account**) and select the policy you created.

   ![Select a policy for the policy set](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-d4e32baaeff2f627c6bc49fa5c53cce0f8da7c83%2Fselect-policy-for-policy-set.png?alt=media)
8. Select the severity and action for policy violations:
   * **Warn & continue** — a warning is displayed if the policy is not met, but the feature flag is saved and you can proceed.
   * **Error and exit** — an error is displayed and the feature flag is not saved if the policy is not met.
9. Click **Apply**, then click **Finish**.
10. The Policy Set is automatically set to **Enforced**. To disable enforcement, toggle off the **Enforced** button.

### FME Feature Flag Definition policies <a href="#fme-feature-flag-definition-policies" id="fme-feature-flag-definition-policies"></a>

FME Feature Flag Definition policies govern the per-environment configuration of feature flags — treatments, targeting rules, and flag sets.

When creating a Policy Set for definitions, select **FME Feature Flag Definition** as the entity type. The evaluation trigger is **On Save**.

For FME Feature Flag Definition policy samples (require default treatment to be off, require flag sets for production), see [FME Feature Flag Definition policies](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md#fme-feature-flag-definition-policies).

### See also <a href="#see-also" id="see-also"></a>

* [Using Harness Policy As Code with FME](/feature-management-experimentation/management-and-administration/policies.md)
* [FME Feature Flag policy samples](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md#fme-feature-flag-policies)
* [FME Feature Flag Definition policy samples](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md#fme-feature-flag-definition-policies)
* [Harness Governance Overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)

{% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-platform/governance/policy-as-code/using-harness-policy-engine-for-fme" %}