> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-platform/governance/policy-as-code/add-a-governance-policy-step-to-a-service-account.md).

# Policy as Code for service accounts

Harness provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies.

You can create a policy and apply it to all [Service Accounts](/harness-platform/use-harness-platform/platform-access-control/add-and-manage-service-account.md). The policy is evaluated during Service account-level events, such as 'On Save,' which happens when a Service account is created or updated. For more details, check out the [Harness Governance Quickstart](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md).

#### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* [Harness Governance Overview](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Harness Governance Quickstart](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)
* Policies use OPA authoring language Rego. For more information, go to [OPA Policy Authoring](https://academy.styra.com/courses/opa-rego).

#### Step 1: Add a Policy <a href="#step-1-add-a-policy" id="step-1-add-a-policy"></a>

1. In Harness, go to **Account Settings** → **Policies** → **New Policy**.

   ![opa-navigation](/files/1CksbF53NTrg87CT3Rdq)
2. The **New Policy** settings will appear.

   Enter a **Name** for your policy → click **Apply**.

   ![opa-create-policy](/files/AtWjyITzDGvRhKVo3XAd)
3. Next, add your Rego policy.

   For example, add a policy to prevent users from creating a service account with names having "success" in it, like 'pipeline-success' or 'successfuldeploy' and so on.

   ```
   package opaexamplepolicy  

   deny[msg] {
       contains(input.serviceAccount.name, "success")
       #input.serviceAccount.name == "word"
       msg = sprintf("CONTAINS Service account name '%s' contains the forbidden word 'success'.", [input.serviceAccount.name])
   }
   ```

   click **Save**

   ![opa-save-policy](/files/UVsa1XEwTpLnTh7VTBIV)

#### Step 2: Add the Policy to a Policy Set <a href="#step-2-add-the-policy-to-a-policy-set" id="step-2-add-the-policy-to-a-policy-set"></a>

After creating your policy, add it to a Policy Set before applying it to your Service Account.

1. In **Policies**, click **Policy Sets** .

   ![opa-select-policy-sets](/files/1yR2Fzyxcplq8CYBrkne)
2. Click **New Policy Set**, Enter a **Name** and **Description** for the Policy Set.

   In **Entity type**, select **Service Account**.

   ![opa-service-setting](/files/TKTEVMp47TV9EHnsywzG)

   In **On what event should the Policy Set be evaluated**, select **On save.** → **Continue**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>IMPORTANT</strong></p><p>Existing service accounts are not automatically updated with policies. Policies are applied only when they are created or updated.</p></div>

#### Step 3: Select Policy evaluation criteria <a href="#step-3-select-policy-evaluation-criteria" id="step-3-select-policy-evaluation-criteria"></a>

1. Click **Add Policy** in **Policy evaluation criteria**.

   Select the policy from the list.

   ![select-opa-policy](/files/Xe7q2tgSr2Y1EzO2jDvw)
2. Choose the severity and action for policy violations.

   You can select one of the following

   * **Warn & continue** - You will receive a warning if the policy is not met when the Service Account is evaluated, but the Service Account will be saved and you may proceed.
   * **Error and exit** - You'll get an error and be exited without saving the Service Account if the policy isn't met when the Service Account is examined.

   ![opa-apply-severity](/files/KcAPx9AWT3k77TEnBqgE)

   Click **Apply**, and then click **Finish**.

#### Step 4: Policy Enforcement. <a href="#step-4-policy-enforcement" id="step-4-policy-enforcement"></a>

1. Now, your Policy Set is automatically set to Enforced, to make it unenforced, toggle off the **Enforced** button.

   ![](/files/WRQ9ofWrjVBjmEAVZVgx)

#### Step 5: Apply a Policy to a Service Account <a href="#step-5-apply-a-policy-to-a-service-account" id="step-5-apply-a-policy-to-a-service-account"></a>

* After creating your Policy Set and adding policies, apply it to a service account.

  You can add a [Service Account](/harness-platform/use-harness-platform/platform-access-control/add-and-manage-service-account.md#create-a-service-account) from any module in your Project in Project setup, or in your Organization, or Account Resources.

1. "Go to **Account Settings** → **Access Control** → **Service Account**

   click **New Service Account**.

   Try using a name denied by your policy, e.g., **"successfuldeploy"**."

   Based on your selection in the Policy Evaluation criteria, you will either receive a warning or an error.

   ![](/files/ICneFx2uVt0uOwXzmiE8)

#### Explore More on Harness Policy as code. <a href="#explore-more-on-harness-policy-as-code" id="explore-more-on-harness-policy-as-code"></a>

* [Harness Policy As Code Overview](/feature-flags/troubleshooting-and-resources/troubleshoot-ff/harness-policy-engine.md)