Enforcing Organization Policies with Enterprise Contract
summary
Enterprise Contract enforces concrete release gates: it validates Sigstore cosign and in-toto attestations, checks image provenance and platform indexes (demo expands an image index into arm64 and amd64), verifies allowed tool bundles and tool age, and requires attached SBOMs and vulnerability reports. Implementation embeds Open Policy Agent (Rego) as the decision engine, runs as a Tekton-aware post-build policy pipeline, emits full lists of violations and suggestions (demo shows 0 violations, 6 successes and a reproduced source-mismatch failure), and supports per-product policies and temporary exclusions.
AI-written summary · about
chapters (7)
- 0:00Introduction to policy enforcement
- 1:03What are organization policies
- 3:32Enterprise Contract tool overview
- 7:44Demo of EC validation
- 12:44Policy configuration structure
- 15:36Creating custom policies
- 18:52Wrap-up and call to action
related talks
36mPolicy-Driven Supply Chain Security with Enterprise Contract
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...
15mPolicy control for Software Supply Chain
22mRethinking Risk, Governance, and Compliance Applying Automation
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
10mStrengthening Supply Chain Security By Enforcing Policies Using OPA G...
24mAutomating Enterprise/Industry Regulation Enforcements During Software Delivery
17mBuilds You (and Others) Can Trust: Meet the AMPEL Policy Engine