> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-platform/governance/policy-as-code/add-a-governance-policy-step-to-a-service-account.md).

# Policy as Code for service accounts

Learn how to use policy as code for a service account.

Harness provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies.

You can create a policy and apply it to all [Service Accounts](/harness-platform/use-harness-platform/platform-access-control/add-and-manage-service-account.md). The policy is evaluated during Service account-level events, such as 'On Save,' which happens when a Service account is created or updated. For more details, check out the [Harness Governance Quickstart](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md).

#### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* [Harness Governance Overview](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Harness Governance Quickstart](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)
* Policies use OPA authoring language Rego. For more information, go to [OPA Policy Authoring](https://academy.styra.com/courses/opa-rego).

#### Step 1: Add a Policy <a href="#step-1-add-a-policy" id="step-1-add-a-policy"></a>

1. In Harness, go to **Account Settings** → **Policies** → **New Policy**.

   ![opa-navigation](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-f0d07da70e1de00be19aa64a3b5048cf9a49e601%2Fopa-navigation.gif?alt=media)
2. The **New Policy** settings will appear.

   Enter a **Name** for your policy → click **Apply**.

   ![opa-create-policy](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-40c48b0fd05a8585853bdfc98b3f4a49c22131eb%2Fopa-create-policy.png?alt=media)
3. Next, add your Rego policy.

   For example, add a policy to prevent users from creating a service account with names having "success" in it, like 'pipeline-success' or 'successfuldeploy' and so on.

   ```
   package opaexamplepolicy  

   deny[msg] {
       contains(input.serviceAccount.name, "success")
       #input.serviceAccount.name == "word"
       msg = sprintf("CONTAINS Service account name '%s' contains the forbidden word 'success'.", [input.serviceAccount.name])
   }
   ```

   click **Save**

   ![opa-save-policy](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-99aa528692aea11736d8fb7c53a43c8c7a5040c0%2Fopa-save-policy.png?alt=media)

#### Step 2: Add the Policy to a Policy Set <a href="#step-2-add-the-policy-to-a-policy-set" id="step-2-add-the-policy-to-a-policy-set"></a>

After creating your policy, add it to a Policy Set before applying it to your Service Account.

1. In **Policies**, click **Policy Sets** .

   ![opa-select-policy-sets](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-560d0f6332fe742848a02295cd4584d0a621109d%2Fopa-select-policy-sets.png?alt=media)
2. Click **New Policy Set**, Enter a **Name** and **Description** for the Policy Set.

   In **Entity type**, select **Service Account**.

   ![opa-service-setting](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-7cbc4e504929867e276c15340ebfc9aedd587758%2Fopa-name-description-entitiy-setup.png?alt=media)

   In **On what event should the Policy Set be evaluated**, select **On save.** → **Continue**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>IMPORTANT</strong></p><p>Existing service accounts are not automatically updated with policies. Policies are applied only when they are created or updated.</p></div>

#### Step 3: Select Policy evaluation criteria <a href="#step-3-select-policy-evaluation-criteria" id="step-3-select-policy-evaluation-criteria"></a>

1. Click **Add Policy** in **Policy evaluation criteria**.

   Select the policy from the list.

   ![select-opa-policy](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-0fd23b0bf1dd6c80ee90c0cdc4aa478da8a1e94c%2Fopa-select-policy.png?alt=media)
2. Choose the severity and action for policy violations.

   You can select one of the following

   * **Warn & continue** - You will receive a warning if the policy is not met when the Service Account is evaluated, but the Service Account will be saved and you may proceed.
   * **Error and exit** - You'll get an error and be exited without saving the Service Account if the policy isn't met when the Service Account is examined.

   ![opa-apply-severity](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-0b521f46c7f60bfcced15509de6359cd38baf6c7%2Fopa-apply.png?alt=media)

   Click **Apply**, and then click **Finish**.

#### Step 4: Policy Enforcement. <a href="#step-4-policy-enforcement" id="step-4-policy-enforcement"></a>

1. Now, your Policy Set is automatically set to Enforced, to make it unenforced, toggle off the **Enforced** button.

   ![](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-be9d08950f7c24d3e9e8779354a462184e2b1d82%2Fopa-un-enforcement.gif?alt=media)

#### Step 5: Apply a Policy to a Service Account <a href="#step-5-apply-a-policy-to-a-service-account" id="step-5-apply-a-policy-to-a-service-account"></a>

* After creating your Policy Set and adding policies, apply it to a service account.

  You can add a [Service Account](/harness-platform/use-harness-platform/platform-access-control/add-and-manage-service-account.md#create-a-service-account) from any module in your Project in Project setup, or in your Organization, or Account Resources.

1. "Go to **Account Settings** → **Access Control** → **Service Account**

   click **New Service Account**.

   Try using a name denied by your policy, e.g., **"successfuldeploy"**."

   Based on your selection in the Policy Evaluation criteria, you will either receive a warning or an error.

   ![](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-6028cf7d31fcdc73448bdc6ff77b613cf48759d9%2Fopa-denied.png?alt=media)

#### Explore More on Harness Policy as code. <a href="#explore-more-on-harness-policy-as-code" id="explore-more-on-harness-policy-as-code"></a>

* [Harness Policy As Code Overview](/feature-flags/troubleshooting-and-resources/troubleshoot-ff/harness-policy-engine.md)

{% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-platform/governance/policy-as-code/add-a-governance-policy-step-to-a-service-account" %}