> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-platform/governance/policy-as-code/policy-as-code-for-overrides.md).

# Policy as Code for Overrides

Harness provides governance using Open Policy Agent (OPA), Policy Management, and Rego policies.

You can create a policy and apply it to all [overrides](/continuous-delivery/use-continuous-delivery/cd-building-blocks/overrides-v2.md) in your Account, Org, or Project. The policy is evaluated on override-level events:

* **On Save** — evaluated when an override is created or updated.

![Override policy set — entity type and event](/files/WVO7Q35Bi4pOELa3FPkM)

For more details, see the [Harness Governance Quickstart](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md).

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* [Harness Governance Overview](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Harness Governance Quickstart](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)
* Policies use the OPA authoring language Rego. For more information, see [OPA Policy Authoring](https://academy.styra.com/courses/opa-rego).

### Step 1: Add a policy <a href="#step-1-add-a-policy" id="step-1-add-a-policy"></a>

1. In Harness, go to **Account Settings** → **Policies** → **New Policy**.
2. Enter a **Name** for your policy and click **Apply**.
3. Add your Rego policy in the editor.

   You can write your own Rego policy or use a sample from the **Library** panel. Select the **Library** tab, choose **Entity: Override** from the dropdown, and pick one of the built-in samples:

   ![Override sample policies in the Library panel](/files/8rh7GneA2hbMZd8kARsc)

   Harness ships two sample policies for overrides:

   * **Override – Config:** Ensures that overriding config files with store type GitHub or fetching from a non-main branch is not allowed.
   * **Override – Variable:** Ensures that overriding a variable of type Secret or changing it to optional is not allowed.

   Below are the Rego policies for both samples.

**Block config file overrides from GitHub or non-main branches**

This policy prevents overriding config files when the store type is GitHub, and also blocks fetching config files from any branch other than `main`.

```
package override

deny[msg] {
  input.overrideEntity.configFiles[_].configFile.spec.store.type == "Github"
  msg := "Cannot override config files to fetch from Github"
}

deny[msg] {
  input.overrideEntity.configFiles[_].configFile.spec.store.spec.branch != "main"
  msg := "Cannot override config files to fetch from non main branch"
}
```

**Block variable overrides that are optional or of type Secret**

This policy prevents overriding variables to make them optional, and blocks overriding variables of type Secret.

```
package override

deny[msg] {
  input.overrideEntity.variables[_].required == false
  msg := "Cannot override variables to optional"
}

deny[msg] {
  input.overrideEntity.variables[_].type == "Secret"
  msg := "Cannot override secret variable type"
}
```

4. Click **Save**.

### Step 2: Add the policy to a policy set <a href="#step-2-add-the-policy-to-a-policy-set" id="step-2-add-the-policy-to-a-policy-set"></a>

After creating your policy, add it to a Policy Set before it can be enforced on overrides.

1. Go to **Policies** → **Policy Sets** → **New Policy Set**.
2. Enter a **Name** and optional **Description** for the Policy Set.
3. In **Entity type**, select **Override**.
4. In **On what event should the Policy Set be evaluated**, select **On Save**.
5. Click **Continue**.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Existing overrides are not automatically evaluated against new policies. Policies are applied only when an override is saved (created or updated).</p></div>
6. In **Policy evaluation criteria**, click **Add Policy**.
7. In the **Select Policy** dialog, choose the scope (**Project**, **Org**, or **Account**) and select the policy you created.

   ![Select a policy for the policy set](/files/AE301WC6MXjq8UBTvaR8)
8. Select the severity and action for policy violations:
   * **Warn & continue** — a warning is displayed if the policy is not met, but the override is saved and you can proceed.
   * **Error and exit** — an error is displayed and the override is not saved if the policy is not met.
9. Click **Apply**, then click **Finish**.
10. The Policy Set is automatically set to **Enforced**. To disable enforcement, toggle off the **Enforced** button.

### Step 3: Apply the policy to an override <a href="#step-3-apply-the-policy-to-an-override" id="step-3-apply-the-policy-to-an-override"></a>

After creating and enforcing your Policy Set, it is automatically evaluated whenever an override is saved.

1. Go to **Deployments** → **Environments** → select an environment → **Service Overrides** (or configure overrides at the appropriate scope).
2. Create or edit an override and click **Save**.
3. Based on your selection in the Policy Evaluation criteria:
   * If the override meets the policy, it is saved successfully.
   * If the override violates the policy and the severity is **Warn & continue**, it is saved with a warning.
   * If the override violates the policy and the severity is **Error and exit**, the save is blocked and an error is displayed.

### OnSave enforcement for Git-backed overrides <a href="#onsave-enforcement-for-git-backed-overrides" id="onsave-enforcement-for-git-backed-overrides"></a>

When an override is stored in Git, commits made directly to the Git repository bypass the Harness UI save flow. Harness now evaluates **onSave** policies when a Git-backed override changes via a webhook, and surfaces the result in the overrides table. An **Override Validation Failed** badge appears in the override row when the latest commit violates an **onSave** policy.

Go to [Enforce onSave policies on Git entities](/harness-platform/use-harness-platform/governance/policy-as-code/enforce-policies-on-git-backed-entities.md) to understand how this enforcement works across all Git-backed entity types.

### See also <a href="#see-also" id="see-also"></a>

* [Harness Governance Overview](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Policy Samples](/harness-platform/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md)