Skip to main content

​
What a Policy Does

Setting Policies A policy turns a judgement you keep repeating into a rule that applies itself. Each policy shows what it does, and what it’s catching right now.

​
Three Possible Actions

Start with Warn. Introducing a new rule as Warn shows you the true blast radius without stopping anyone’s merge. Promote it to Block once the backlog it surfaces is dealt with.

​
Writing a Policy

Select + New Policy. Start from a template, or build from scratch. The built-in set covers the rules most teams want first, such as banned licences and known-exploited vulnerabilities. You then have two ways to express the rule, and they stay in sync:
  • Sentence — build the condition by picking fields, operators, and values. No syntax to learn.
  • Code — write the expression directly, with autocomplete and live validation, for conditions the builder can’t express.
Choose the action, save, and the policy is live on the next evaluation.

​
Rules About Cryptography

With Cryptography enabled, the same builder gains a Crypto field group, and seven starter templates are available under Crypto: The Crypto group also exposes the finding’s Purpose (confidentiality, excluded, support, or unknown) and three evidence-only EAR signals, each met, not_met, unknown, or not_evaluated:
Whenever one of these fields is in a sentence, the builder repeats the fixed disclaimer: “Export-control evidence supports your self-classification. It is not legal advice and does not determine or imply an ECCN.” Use has() when a field may be absent, an absent field means the producer supplied no value; unknown means the producer supplied an applicable test but couldn’t resolve it; not_evaluated means the test had no applicable occurrence evidence.
A few of these read more precisely than they look:
  • Reachability has three values, not two, a rule writes them reachable, unreachable, and unknown, which the finding itself shows as Reachable, Not Reached, and Unknown, so a rule that should only fire on proven usage must say reachable; asking for “not unreachable” also catches everything the analysis couldn’t decide.
  • Key size exists only where Earnie resolved an actual key length; where it couldn’t, the field is absent and a key-size rule passes over the finding rather than guessing.
  • Post-quantum status has four values, and the distinction is the point: Vulnerable (a quantum computer breaks it, the classical public-key families, at any key length), Safe (a post-quantum algorithm), Not applicable (nothing for a quantum computer to attack, hashes, symmetric ciphers, MACs, and key-derivation functions live here, so a broken hash like MD5 is a severity problem, never a migration item), and Unassessed (Earnie hasn’t curated that algorithm and won’t claim either way). The older Quantum Safe yes/no field still works but is deprecated in favour of these four, since one yes/no couldn’t tell “we checked, it’s fine” from “we haven’t looked.” On an unassessed asset the yes/no field is absent rather than false, so a rule on it must be written as “Quantum Safe is set and is false”; a rule that only says “Quantum Safe is false” errors on the findings it can’t answer for, which is why the four-value field is the one to write new rules against.
  • Risk assessed is the companion fact: whether Earnie’s curated tables actually decided this finding’s severity. When it’s false, the severity is a placeholder rather than a judgement, and reachability doesn’t raise it, which is why an unassessed finding never escalates into a blocking severity it was never assessed for.
The field picker’s Crypto group carries a link to Settings → Crypto Assessment, where the families and verdicts a crypto rule matches on are published in full, useful when deciding which family to name. It opens in a new tab, so an unsaved policy draft survives the detour.
Without Cryptography enabled, the Crypto field group, crypto templates, and regulatory template sets are withheld, no field group, no templates, nothing to discover.

​
Regulatory Template Sets

On + New Policy, a regulatory template set enables its mapped starter templates for the project in one action. Each template card shows the clause it’s mapped to.
Neither template set blocks reachable TLS 1.3. Earnie doesn’t verify FIPS 140-3 module validation.

​
What a Policy Evaluates

Every policy names one kind of finding. A new policy asks for it as Evaluates, next to Category, and a policy started from a template arrives with the template’s own answer already chosen. The list offers only the scanners your organisation has enabled, and the choice is fixed once the policy is saved, it decides which fields the rule may read, so changing it later would invalidate the rule itself. The policy’s Where This Applies panel reads it back as “Evaluates Crypto findings.”
Fields that aren’t present on every finding must be checked before they’re read. A rule that asks whether a key is under 2048 bits has to say so about occurrences whose key length Earnie actually resolved, the Sentence builder writes that check for you, and the code editor refuses to save a rule that reads such a field without one, naming the field and the check to add.

​
Where a Policy Applies

A policy belongs to your organisation rather than to a single project, so the same rule can be attached to several projects at once. Open a policy and its Where This Applies panel names every project it’s currently attached to, and the repository connected to each one, so “which repositories does this cover?” has a direct answer.
A project with no repository connected yet is marked as covering nothing.
Because the rule is shared, editing it changes the gate for every project on that list. When a policy is attached to more than one, Earnie asks you to confirm before saving and shows you exactly which projects the change reaches. A policy attached to a single project saves without the extra step.

​
Cloning a Policy

To start a new rule from an existing one instead of a blank template, open a policy and choose Clone Policy from its More Actions menu. The copy is entirely independent, it starts with the same rule and settings, but from then on the two are edited separately, so changing one never affects the other, including their parameter values. The clone is named after the source with “(copy)” appended, gets its own identifier, and is attached to the project you cloned it from so you can find and tune it immediately.
A copy of a built-in template becomes a regular custom policy, so it’s yours to edit freely.

​
What’s Next

With a policy live, the next step is seeing what happens on the other side of it, when the gate actually blocks a merge.