> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/customization/policies/custom-policies.md).
# Create a custom policy
This article will show you how to create a custom policy for Qwiet AI by Harness.
> You must have administrative privileges to create or modify policies.
## Qwiet AI by Harness policy templates
Qwiet AI by Harness offers two default policy templates that you can use as the foundation when creating new custom policies:
* **default**: creates a policy that imports all standard definitions used by Qwiet **and** the generic dictionary of sensitive data variables
* **no-dictionary**: creates a policy that *excludes* the use of Qwiet's generic dictionary of sensitive data variables; Qwiet only uses the standard definitions to identify vulnerabilities
We recommend using one of the default policy templates to create a custom policy instead of creating one from scratch.
## Creating a custom policy
To create and use a custom policy, you will need to:
1. Create the new policy file
2. Write the policy definition
3. Validate your policy
4. Upload the policy to the Qwiet repository
5. Assign the policy to an application
### Step 1: Create a new policy file
Run the following to create a new policy file:
```
sl policy create [default|no-dictionary]
```
 
| **Parameter** | **Description** |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| `default` | Indicates Qwiet AI by Harness should use the default policy template. Choose this or `no-dictionary`; do not use both |
| `no-dictionary` | Indicates Qwiet AI by Harness should use the policy template that omits the sensitive data dictionary; Choose this or `default`; do not use both |
| `` | The location where you want Qwiet AI by Harness to create your new policy; policy files use the `.policy` extension |
### Step 2: Write the policy definition
Open your newly created policy file using a text editor. You can either:
* Write new policy definitions
* Edit the imported policy definitions (if you created the file using the **default** policy as your template)
### Step 3: Validate the new policy
After you write new policy definitions or edit the existing definitions, you must validate your new policy to make sure that there are no errors. To do so, run:
```
sl policy validate
```
 
| **Parameter** | **Description** |
| ------------- | ---------------------------- |
| `` | The file path to your policy |
This command returns a non-zero exit status code if there is a problem with either your policy's syntax or semantics.
If there are no issues with your policy, you'll see a message similar to the following:
```
policy `test-policy.policy` is valid
```
 
Otherwise, you'll receive a notification similar to the following with error-related information:
```
Error: policy verification failed: invalid policies:
Policy format error:
pos: 6:19
message: mismatched input 'ssn' expecting {'VAR', 'VAR_REGEX'}
[ERROR] policy verification failed: invalid policies:
Policy format error:
pos: 6:19
message: mismatched input 'ssn' expecting {'VAR', 'VAR_REGEX'}
| issuer=/go/src/github.com/ShiftLeftSecurity/go-services/cmd/sl/main.go:1259
```
 
### Step 4: Upload the policy to the Qwiet repository
Qwiet AI by Harness can only use a policy if it is located in the Qwiet repository. To upload a custom policy, run:
```
sl policy push :
```
 
| **Parameter** | **Description** |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `` | The name of your new policy. You may use underscores, but you may not use hyphens (e.g., `test-policy` isn't valid, but `test_policy` is valid) |
| `` | **Optional.** The policy version (e.g., if your policy is **myPolicy:0.0.1**, then your policy version is **0.0.1**) |
| `` | The file path to your policy |
If you successfully upload your policy, Qwiet returns to the CLI your Org ID policy and tag:
```
uploaded policy: d64...2399/test_policy:latest
```
 
You can check for this policy in the repository by using the **info** command. The **info** command lists all policies uploaded with the specified label available to you.
Please note that you must provide the *complete* policy name (e.g., `/:` )
```
sl policy info :
```
 
| **Parameter** | **Description** |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `` | The name of the policy you want found; if omitted, Qwiet returns all available policies |
| `` | **Optional.** The policy version (e.g., if your policy is **myPolicy:0.0.1**, then your policy version is **0.0.1**); if omitted, the response includes all authorized policies |
You can expect a response similar to the following:
```
Found policies:
[1] Policy:
Name: d64...99/test_policy
Tag: latest
Created at: 2020-06-02T11:43:30-05:00
Updated at: 2020-06-02T11:43:30-05:00
Hash: a0200f87452439017b6d1403d90919923ae739d048ac38b95fa490557f19ba4c
```
 
Since you can overwrite policy filenames, you may get multiple policy entries returned for a single table/tag.
### Step 5: Assign the new policy
When running Qwiet AI by Harness to analyze your application, you'll need to assign the policy for use with the app:
```
sl analyze --policy --app
```
 
| **Parameter** | **Description** |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `` | The name of the policy you want to be used for code analysis; if omitted, Qwiet uses its baseline policy |
| `` | **Optional.** The policy version (e.g., if your policy is **myPolicy:0.0.1**, then your policy version is **0.0.1**); if omitted, the response includes all authorized policies |
| `name` | The name of your application |
A sample command might look like the following:
```
sl analyze --policy d64f...399/test_policy:latest
```
 
## How to turn a custom policy into a default policy
If you find yourself using a custom policy frequently, you can turn it into a default policy that Qwiet AI by Harness automatically uses whenever it analyzes code:
```
sl policy assignment set
```
 
| **Parameter** | **Description** |
| --------------- | --------------------------------------------------------------------------------------- |
| `` | The name of the policy you want found; if omitted, Qwiet returns all available policies |
Alternatively, you can also set a custom policy as the default policy for a specific application or application version (instead of globally for use with all applications):
```
sl policy assignment set --project :
```
 
| **Parameter** | **Description** |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `` | The name of the policy you want found; if omitted, Qwiet returns all available policies |
| `` | **Optional.** The policy version (e.g., if your policy is **myPolicy:0.0.1**, then your policy version is **0.0.1**); if omitted, the response includes all authorized policies |
| `name` | The name of your application |
When using a custom policy, Qwiet AI by Harness tends to identify fewer vulnerabilities in your application than when using a default policy.
## Editing a custom policy
You can edit a custom policy at any time by opening the file up in a text editor, making the required changes, and saving the file. You will also need to [validate your file](#step-3-validate-the-new-policy) and [upload it to the Qwiet repository](#step-4-upload-the-policy-to-the-qwiet-repository).