Policy Management

Team Server stores versioned policies for CI/CD pipelines. Builds can fall back to local files; workloads always use local policies.

Create and Edit a Policy

1. Open Policies > Create and enter name, description, version, and JSON.
2. Optionally define Variables; inspect expanded content in Preview.
3. Validate and create, then assign the policy to pipelines.

Validation checks schema, expressions, variables, and the 262,144-byte content limit. Preview expands custom variables and leaves five job-specific runtime variables unresolved.

The <create> shortcut in an unassigned pipeline’s Policy column prefills its details and creates/assigns atomically. Creating from Policies alone does not assign it.

The creator becomes the first owner. Owners and Administrators manage content, history, variables, co-owners, assignments, and deletion. See ownership permissions.

Review and Restore Policy History

Open a policy for its three latest revisions; View all n revisions opens history, ten per page, newest first by local date. Authorized readers can Compare with current. Owners and Administrators can Revert name, description, version, and content, validated against current variables.

Assign Policies to Pipelines

Open Policies > Assign Policy, select pipelines, then Assign. Each pipeline has one assigned policy covering all builds inside its provider boundary. Assignments do not apply to workloads or deployments.

How a Build Chooses a Policy

At job start:

1. The CLI selects and validates --policy, otherwise .endura/policy.json in its current directory, otherwise an empty derive policy. --workspace does not change file lookup. A missing explicit or invalid selected file stops startup.
2. --mode overrides the local mode, retaining its rules.
3. For a recognized CI build, the Sensor sends a heartbeat. If Team Server matches an existing pipeline and returns a policy, that replaces local rules and mode, including explicit CLI selections.

Without a recognized build, exact pipeline match, reachable compatible server, or returned policy, the local selection remains. Default derive permits operations while learning; use a reviewed local enforce policy when fallback enforcement is required. Empty enforce permits nothing; hook capabilities determine enforcement.

For pre-checkout fallback, provision an external policy and pass an absolute path. The repository file may be absent or stale. A successful central lookup still overrides it.

A job that starts without a Team Server association is not rebound automatically. After recovery, stop and start it again to retrieve central policy and associate telemetry. Existing enforcement continues during outages or version mismatch.

AWS CodeBuild, Azure Pipelines, and CircleCI have runtime detection without discovery. Without an exact existing pipeline, they retain local policies and their build records and violations are not saved remotely.

Apply Changes to Running Jobs

Editing, reverting, assigning, unassigning, or changing variables affects future starts. To replace an active policy, repeat endura job start on the same workspace with the intended fallback and mode. This replaces registration and resets derivation. Check the effective policy before resuming work.

Workload Policies

Manual workloads use local policy selection. Team Server inventories their deployment, receives violations, and provides no workload policy assignment or permit proposals.

Permit a Build Violation

An Operator owning the assigned policy, or an Administrator, can propose permissions for up to 1,000 violations from one pipeline:

Review the editable diff and enter a change description. Team Server validates and creates a new version. Workload violations cannot be permitted; historical events are unchanged.

Inspect the Effective Policy

ENDURA_JOB_ID=$(endura job start --workspace /workspace) || exit $?
endura policy describe "$ENDURA_JOB_ID"

The 16-digit job ID selects the policy actually loaded, including a central override. Derive-mode output shows the current pruned derivation.