> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-ai/use-harness-platform/governance/policy-as-code/using-harness-policy-engine-for-fme.md).

# Policy As Code for FME Feature Flags

Learn how to create, update, and view policies and policy sets for FME feature flags and feature flag definitions.

Harness provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies.

You can create a policy and apply it to FME (Feature Management & Experimentation) feature flags and feature flag definitions in your Account, Org, or Project. Harness supports two FME entity types:

* **FME Feature Flag**: the feature flag itself (name, description, status, owners, tags).
* **FME Feature Flag Definition**: the per-environment definition of a feature flag (treatments, targeting rules, flag sets).

Both entity types are evaluated on the **On Save** trigger, which fires whenever a feature flag or definition is created, updated, deleted, or archived.

Go to [Using Harness Policy As Code with FME](/feature-management-experimentation/management-and-administration/policies.md) for complete documentation on FME policy setup, including the input payload reference.

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

Complete these steps before you create a policy for FME entities.

* [Harness Governance Overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Harness Governance Quickstart](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)
* Policies use the OPA authoring language Rego. Go to [OPA Policy Authoring](https://academy.styra.com/courses/opa-rego) to learn Rego syntax.

### FME feature flag policies <a href="#fme-feature-flag-policies" id="fme-feature-flag-policies"></a>

#### Step 1: Add a policy <a href="#step-1-add-a-policy" id="step-1-add-a-policy"></a>

Create the Rego policy that Harness evaluates against your FME feature flags.

1. In Harness, go to **Account Settings** → **Policies** → **New Policy**.
2. Enter a **Name** for your policy and click **Apply**.
3. Add your Rego policy in the editor.

   You can write your own Rego policy or use a sample from the **Library** panel. Select the **Library** tab, choose **Entity: FeatureFlag** from the dropdown:

   ![FME Feature Flag sample policies in the Library panel](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-a80a28d72c9d29d61d55ac8d11902adaff428e0d%2Ffme-feature-flag-sample-policies.png?alt=media)

   Harness ships three sample policies for FME feature flags:

   * **FME Feature Flag – Naming Convention:** Ensures that FME feature flag names follow organizational naming conventions.
   * **FME Feature Flag – Required Tags:** Ensures that FME feature flags have required tags for categorization and tracking.
   * **FME Feature Flag – Team Ownership Required:** Ensures that FME feature flags have at least one owner and all owners are teams, not individual users.

   Below are the Rego policies for all three samples.

**Enforce naming conventions**

This policy ensures feature flag names start with `ff_`, contain only lowercase letters, numbers, and underscores, and are between 5 and 100 characters.

```rego
package fme_feature_flags

deny[msg] {
  not regex.match("^ff_[a-z0-9][a-z0-9_]*$", input.featureFlag.name)
  msg := sprintf("FME Feature Flag name '%s' must start with 'ff_' and contain only lowercase letters, numbers, and underscores", [input.featureFlag.name])
}

deny[msg] {
  count(input.featureFlag.name) < 5
  msg := sprintf("FME Feature Flag name '%s' is too short (minimum 5 characters)", [input.featureFlag.name])
}

deny[msg] {
  count(input.featureFlag.name) > 100
  msg := sprintf("FME Feature Flag name '%s' is too long (maximum 100 characters)", [input.featureFlag.name])
}
```

**Require tags for categorization**

This policy ensures every feature flag has at least one tag and includes required tags for `owner`, `team`, `service`, and `component`.

```rego
package fme_feature_flags

deny[msg] {
  count(input.featureFlag.tags) == 0
  msg := sprintf("FME Feature Flag '%s' must have at least one tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("owner")
  msg := sprintf("FME Feature Flag '%s' must have an 'owner' tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("team")
  msg := sprintf("FME Feature Flag '%s' must have a 'team' tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("service")
  msg := sprintf("FME Feature Flag '%s' must have a 'service' tag", [input.featureFlag.name])
}

deny[msg] {
  not contains_required_tag("component")
  msg := sprintf("FME Feature Flag '%s' must have a 'component' tag", [input.featureFlag.name])
}

contains_required_tag(tag_name) {
  input.featureFlag.tags[_] == tag_name
}

warn[msg] {
  input.featureFlag.description == ""
  msg := sprintf("FME Feature Flag '%s' should have a description for better documentation", [input.featureFlag.name])
}
```

**Enforce team ownership**

This policy ensures every feature flag has at least one owner and that all owners are teams rather than individual users.

```rego
package fme_feature_flags

deny[msg] {
  count(input.entityMetadata.owners) == 0
  msg := sprintf("FME Feature Flag '%s' must have at least one owner", [input.featureFlag.name])
}

deny[msg] {
  some i
  owner := input.entityMetadata.owners[i]
  owner.ownerType == "user"
  owner_name := object.get(owner, "ownerName", owner.ownerId)
  msg := sprintf("FME Feature Flag '%s' has an individual user owner '%s'. Owners must be teams, not individual users", [input.featureFlag.name, owner_name])
}
```

4. Click **Save**.

#### Step 2: Add the policy to a policy set <a href="#step-2-add-the-policy-to-a-policy-set" id="step-2-add-the-policy-to-a-policy-set"></a>

Add the policy to a policy set scoped to the FME Feature Flag entity type.

1. Go to **Policies** → **Policy Sets** → **New Policy Set**.
2. Enter a **Name** and optional **Description** for the Policy Set.
3. In **Entity type**, select **FME Feature Flag**.
4. In **On what event should the Policy Set be evaluated**, select **On Save**.
5. Click **Continue**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Existing feature flags are not automatically evaluated against new policies. Policies are applied only when a feature flag is saved (created, updated, deleted, or archived).</p></div>
6. In **Policy evaluation criteria**, click **Add Policy**.
7. In the **Select Policy** dialog, choose the scope (**Project**, **Org**, or **Account**) and select the policy you created.

   ![Select a policy for the policy set](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-d4e32baaeff2f627c6bc49fa5c53cce0f8da7c83%2Fselect-policy-for-policy-set.png?alt=media)
8. Select the severity and action for policy violations:
   * **Warn & continue**: a warning is displayed if the policy is not met, but the feature flag is saved and you can proceed.
   * **Error and exit**: an error is displayed and the feature flag is not saved if the policy is not met.
9. Click **Apply**, then click **Finish**.
10. The Policy Set is automatically set to **Enforced**. To disable enforcement, toggle off the **Enforced** button.

### FME feature flag definition policies <a href="#fme-feature-flag-definition-policies" id="fme-feature-flag-definition-policies"></a>

FME Feature Flag Definition policies govern the per-environment configuration of feature flags: treatments, targeting rules, and flag sets.

When creating a Policy Set for definitions, select **FME Feature Flag Definition** as the entity type. The evaluation trigger is **On Save**.

Go to [FME Feature Flag Definition policies](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md#fme-feature-flag-definition-policies) for policy samples that require the default treatment to be off or require flag sets for production.

### See also <a href="#see-also" id="see-also"></a>

Related governance topics cover FME policy setup and the broader policy set workflow.

* [Using Harness Policy As Code with FME](/feature-management-experimentation/management-and-administration/policies.md)
* [FME Feature Flag policy samples](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md#fme-feature-flag-policies)
* [FME Feature Flag Definition policy samples](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md#fme-feature-flag-definition-policies)
* [Harness Governance Overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)

### Next steps <a href="#next-steps" id="next-steps"></a>

Continue your governance setup with these related resources.

* Go to [FME Feature Flag policy samples](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md#fme-feature-flag-policies) to see more Rego examples for FME feature flags.
* Go to [Using Harness Policy As Code with FME](/feature-management-experimentation/management-and-administration/policies.md) for the complete FME policy input payload reference.
* Go to [Harness Governance Overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md) to understand how policy sets fit into the wider governance model.

{% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-platform/governance/policy-as-code/using-harness-policy-engine-for-fme" %}