> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-platform/governance/policy-as-code/using-harness-policy-as-code-for-variables.md).

# Using Harness Policy as Code for Variables

{% hint style="info" %}
**FEATURE FLAG DETAILS**

This feature is currently behind the feature flag `PL_ENABLE_OPA_FOR_VARIABLES`. Contact [Harness Support](mailto:support@harness.io) to enable the feature.
{% endhint %}

Harness provides governance and compliance controls through integration with Open Policy Agent (OPA), Policy Management, and Rego policies.

You can define and enforce custom policies on Variables across account, organization, and project [scopes](/harness-platform/use-harness-platform/platform-access-control.md#permissions-hierarchy-scopes). These policies will be evaluated during the **On Save** event (when a Variable is created or updated). This ensures that Variable configurations meet your organization's security, naming, or value standards before they are persisted.

#### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* [Harness Governance Overview](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Harness Governance Quickstart](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)
* Policies use OPA authoring language Rego. For more information, go to [OPA Policy Authoring](https://academy.styra.com/courses/opa-rego).

#### Step 1: Add a Policy <a href="#step-1-add-a-policy" id="step-1-add-a-policy"></a>

1. In Harness, go to **Account Settings** → **Policies** → **New Policy**.

   ![opa-navigation](/files/1CksbF53NTrg87CT3Rdq)
2. The **New Policy** settings will appear. Enter a **Name** for your policy → click **Apply**.

   ![opa-variable](/files/dv2Tc2ltxYNmaShCMUgv)
3. **Add your Rego policy.**

   3.1 Use Your Own Rego Policy: You can add a custom Rego policy based on your requirements. For example, let's add a policy to restrict the creation or updation of Variables starting with `helloworld` by users with the Account viewer role:

   ````
    ```
        package variable

        deny[msg] {
            startswith(input.variable.name, "helloworld")

            some i
            input.metadata.roleAssignmentMetadata[i].roleIdentifier == "_account_viewer"

            msg := "Variable with name starting with 'helloworld' is not allowed when role '_account_viewer' is present"
        }
    ```
   ````

   3.2. Use an existing Rego Policy from the Harness Policy Library: To select an existing policy, go to the Library, search for variables, select the **Variable - Deny Edit** template, and click **Use This Sample** at the bottom.

   ![sample-opa-policy](/files/61BIy3wVlSycMNATvug9)
4. **Test** your policy against a sample input, and then click **Save**.

#### Step 2: Add the Policy to a Policy Set <a href="#step-2-add-the-policy-to-a-policy-set" id="step-2-add-the-policy-to-a-policy-set"></a>

After creating your policy, add it to a Policy Set before applying it to your Variable.

1. In **Policies**, click **Policy Sets**.

   ![opa-select-policy-sets](/files/1yR2Fzyxcplq8CYBrkne)
2. Click **New Policy Set**. Enter a **Name** and **Description**(optional) for the Policy Set. In **Entity type**, select **Variable**, and for **On what event should the Policy Set be evaluated**, select **On save.**

   Click **Continue** to proceed.

   ![opa-variable-setting](/files/hV3ZRicAXjDNsHcWU2bw)

#### Step 3: Select Policy evaluation criteria <a href="#step-3-select-policy-evaluation-criteria" id="step-3-select-policy-evaluation-criteria"></a>

1. Click **Add Policy** in **Policy evaluation criteria**. Select the policy from the list.
2. Choose the severity for policy violations and click **Apply**. Currently, only one option is supported: **Error and exit**.

   `Error and exit` – On saving a variable, if the policy is violated, an error will be shown and you won't be allowed to proceed.

   ![select-opa-policy](/files/Tbd5qi4tXmtNYQoWhlhA)
3. Click **Finish**.

#### Step 4: Policy Enforcement. <a href="#step-4-policy-enforcement" id="step-4-policy-enforcement"></a>

Toggle on the **Enforced** button, to enforce the policy.

![opa-variable](/files/0a3GrXK562Vk2FhQHVgL)

#### Step 5: Evaluate a Policy to a Variable <a href="#step-5-evaluate-a-policy-to-a-variable" id="step-5-evaluate-a-policy-to-a-variable"></a>

```
After creating your Policy Set and adding policies, let's try it out.
```

1. Go to **Account Settings** → **Account-level resources** → **Variables**. Click **New Variable**.

   ![new-variable](/files/szhdX8o0gkkkaR9N7cjb)
2. Try using a variable name denied by your policy, e.g., **"helloworld-123"**.

   Once you try to save the variable the Policy will be evaluated, and you will receive an error.

   ![](/files/RgTNRRopPa0N1ceVYyCy)

#### Explore More on Harness Policy as code. <a href="#explore-more-on-harness-policy-as-code" id="explore-more-on-harness-policy-as-code"></a>

* [Harness Policy As Code Overview](/feature-flags/troubleshooting-and-resources/troubleshoot-ff/harness-policy-engine.md)