> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/software-supply-chain-assurance/use-scs/artifact-security/slsa/create-slsa-policies.md).

# Create SLSA policies

This document provides a step-by-step guide on how to create SLSA Policies. For guidance on how to write these policies, please refer to the section on [write policy definitions](/software-supply-chain-assurance/troubleshooting-and-resources/how-to-guides/define-sbom-policies.md). To learn about implementing SLSA policies, follow the instructions in the section on [enforcing SLSA policies](/software-supply-chain-assurance/use-scs/artifact-security/slsa/verify-slsa.md#enforce-policies-on-slsa-provenance).

#### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

As you learn to create SLSA policies, ensure you thoroughly review

* [Harness Policy as Code - Overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md)
* [Harness Policy as Code - Quickstart](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md)

The Harness Policy Library provides sample policies that simplify the process of creating and enforcing them against SLSA. Here is a guide on how to utilize these samples for policy creation.

{% hint style="info" %}
Policies can be created at the account, organization, and project levels, this guide will focus on creating a policy at the account level. For instructions on crafting policies for the organization and project levels, go to the linked [overview guide](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md) to follow a similar process.
{% endhint %}

### Create SLSA policies <a href="#create-slsa-policies" id="create-slsa-policies"></a>

You must create a set of OPA policies that you want Harness SCS to use for SLSA Provenance verification. You can create a dedicated SLSA Provenance verification policy set or use existing policy sets that you have already created. Go to the [Harness Policy As Code overview](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-overview.md) to create policies in Harness.

{% hint style="info" %}
OPA policies used for SLSA Provenance verification are different from [SBOM policies](/software-supply-chain-assurance/use-scs/open-source-management/create-sbom-policies.md) used for SBOM policy enforcement.
{% endhint %}

1. In your Harness Project, under **Project Setup**, go to **Policies**. You can also create policies at the Account and Org scopes.
2. Select **Policies**, and then [create policies](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md#create-the-policy) for the individual rules that you want to enforce. You can select from the policy library or write your own policies.
3. [Create policy sets](/harness-ai/use-harness-platform/governance/policy-as-code/harness-governance-quickstart.md#step-3-create-a-policy-set) to group related policies. You must have at least one policy set.

#### SLSA policy example <a href="#slsa-policy-example" id="slsa-policy-example"></a>

Here is an example of an OPA policy that could be used to verify an [SLSA Provenance generated in Harness](/software-supply-chain-assurance/use-scs/artifact-security/slsa/generate-slsa.md). If you are verifying provenance from a third-party build system provider, make sure your OPA policies reflect the provenance structure used by that build system provider. Different providers might use different SLSA Provenance structures.

**Validate repo and branch:**

```
package slsa

# Build repo must be 'https://github.com/abc/abc-sample'. SLSA verification fails if a different repo is detected. <a href="#build-repo-must-be-httpsgithubcomabcabc-sample-slsa-verification-fails-if-a-different-repo-is-detected" id="build-repo-must-be-httpsgithubcomabcabc-sample-slsa-verification-fails-if-a-different-repo-is-detected"></a>
deny[msg]{
  input[0].outcome.stepArtifacts.provenanceArtifacts[0].predicate.buildDefinition.externalParameters.codeMetadata.repositoryURL != "https://github.com/abc/abc-sample"
  msg := "Repository verification failed in Provenance"  
}

# Build branch must be 'main'. SLSA verification fails if a different branch is detected. <a href="#build-branch-must-be-main-slsa-verification-fails-if-a-different-branch-is-detected" id="build-branch-must-be-main-slsa-verification-fails-if-a-different-branch-is-detected"></a>
deny[msg]{
  input[0].outcome.stepArtifacts.provenanceArtifacts[0].predicate.buildDefinition.externalParameters.codeMetadata.branch != "main"
  msg := "Branch verification failed in provenance"  
}
```

**Validate trigger type:**

```

package slsa

deny[msg] {
  input[0].outcome.stepArtifacts.provenanceArtifacts[0].predicate.buildDefinition.externalParameters.trigger != "push"
  msg := "Invalid trigger type: only 'push' is allowed"
}


```

**Validate pipeline identifier:**

```

package slsa

deny[msg] {
  input[0].outcome.stepArtifacts.provenanceArtifacts[0].predicate.buildDefinition.buildType != "https://example.com/ci-pipeline@v1"
  msg := "Pipeline identifier does not match expected value"
}


```

For more examples, go to [Policy samples](/harness-ai/use-harness-platform/governance/policy-as-code/sample-policy-use-case.md).