> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/3.0/harness-platform-resources/governance/policy-as-code/policy-as-code-faqs.md).

# Policy as Code FAQs

This topic addresses some frequently asked questions about Policy as Code support in Harness.

#### Can we use our own Gatekeeper and have Harness manage Gatekeeper and policies? <a href="#can-we-use-our-own-gatekeeper-and-have-harness-manage-gatekeeper-and-policies" id="can-we-use-our-own-gatekeeper-and-have-harness-manage-gatekeeper-and-policies"></a>

No, Harness has an internal policy service that manages the policies and evaluates policies against Harness object payloads.

#### Can policies be managed in Git? <a href="#can-policies-be-managed-in-git" id="can-policies-be-managed-in-git"></a>

Yes, you can manage policies in Git. For more information, go to [Configure Git Experience for OPA](/harness-ai/use-harness-platform/governance/policy-as-code/configure-gitexperience-for-opa.md).

#### Can you reference Harness variables expressions in policies? <a href="#can-you-reference-harness-variables-expressions-in-policies" id="can-you-reference-harness-variables-expressions-in-policies"></a>

No, you cannot reference Harness variable expressions such as `<+service.name>` directly in a policy. You can map a Harness variable expression to a fixed JSON Key in the Governance Policy Step and then evaluate it against a policy. For more information, go to [Add a Policy step to a pipeline](/continuous-delivery/use-continuous-delivery/cd-building-blocks/advanced/cd-governance/add-a-governance-policy-step-to-a-pipeline.md).

#### What can I write policies against? <a href="#what-can-i-write-policies-against" id="what-can-i-write-policies-against"></a>

You can now write policies against:

* Pipelines
* Templates
* Connectors
* Secrets
* Feature Flags
* Custom
* Service

Support for the following entities is on our long-term roadmap:

* Service
* Environments
* RBAC

#### Can policy sets be managed in Git? <a href="#can-policy-sets-be-managed-in-git" id="can-policy-sets-be-managed-in-git"></a>

No, you cannot manage policy sets in Git.

#### When can policies be evaluated? <a href="#when-can-policies-be-evaluated" id="when-can-policies-be-evaluated"></a>

* **On Save:** Policies can be applied via a policy set to a specific object when a user is trying to update or create it. The following object types are supported:
  * Feature Flags
  * Connectors
  * Secrets
  * Templates
  * Pipelines
  * Service

{% hint style="info" %}
**NOTE**

Policies applied to the Service entity during **On Run** and **On Save** events is currently behind the feature flag `CDS_ENABLE_SERVICE_ON_RUN_OPA_EVAL`. Contact [Harness Support](mailto:support@harness.io) to enable the feature.
{% endhint %}

* **On Run:** Policies can be applied when a pipeline is running and a value is computed. The following object type is supported:
  * Pipelines
  * Service

{% hint style="info" %}
**NOTE**

Policies applied to the Service entity during **On Run** and **On Save** events is currently behind the feature flag `CDS_ENABLE_SERVICE_ON_RUN_OPA_EVAL`. Contact [Harness Support](mailto:support@harness.io) to enable the feature.
{% endhint %}

* **On Step:** When using the Governance Step, you can evaluate a policy against the JSON that is generated from the step. The following object type is supported:
  * Custom

#### What version of the OPA library does Harness platform use? <a href="#what-version-of-the-opa-library-does-harness-platform-use" id="what-version-of-the-opa-library-does-harness-platform-use"></a>

Harness platform uses the Open Policy Agent (OPA) library version **0.62.0**.

For more details, you can refer to [OPA v0.62.0](https://github.com/open-policy-agent/opa/tree/v0.62.0).

#### Can I use `http.send` in policies evaluated on Harness SaaS? <a href="#can-i-use-httpsend-in-policies-evaluated-on-harness-saas" id="can-i-use-httpsend-in-policies-evaluated-on-harness-saas"></a>

No. The Rego network builtins `http.send` and `net.lookup_ip_addr` are supported **only** when the policy set runs on your own infrastructure. Policies evaluated on Harness SaaS cannot use these builtins.

To use HTTP calls or hostname lookups from Rego, configure the policy set to [run in your own environment](/harness-ai/use-harness-platform/governance/policy-as-code/run-policies-in-your-environment.md). This requires the `OPA_RUN_ON_CUSTOMER_INFRA` feature flag and is supported only for **Pipeline** policy sets with the **On Run** action.

#### How can I tell what policy sets are using my policy? <a href="#how-can-i-tell-what-policy-sets-are-using-my-policy" id="how-can-i-tell-what-policy-sets-are-using-my-policy"></a>

Find a full list of your policies for your scope by going to the relevant settings page: **Project Settings**, **Organization Settings**, or **Account Settings**

Then, go to the **Security and Governance** section > **Policies**.

In the top right of this overview page, select **Policies**.

Here you'll see a full list of policies, along with the policy store and the number of referenced policy sets for each one. Click the **View** button to open a modal showing the complete list of referenced policy sets.