> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Policy

> Set one policy for your tenant in SafeDep Cloud: block and trust packages, set the dependency cooldown, and choose what fails a pull request check.

The cloud policy is one [policy](https://docs.safedep.io/concepts/policy.md) for your tenant in SafeDep Cloud. A security admin changes it with the [safedep CLI](https://docs.safedep.io/get-started/cli-tools.md), and PMG and the pull request checks apply it. You change the policy of the whole fleet with no new MDM package.

> [!NOTE]
>
> The cloud policy needs the SafeDep Cloud Team or Enterprise plan. See [pricing](https://safedep.io/pricing).

## What the cloud policy controls

* **Package rules.** Block a package for the whole tenant, or trust one package after a false positive. See [Package Rules](https://docs.safedep.io/concepts/package-rules.md).
* **Dependency cooldown.** Hold back package versions that are younger than a minimum age.
* **Pull request checks.** Choose the lowest vulnerability severity that fails a check.

You can set a value for the whole tenant, or for a group of endpoints or projects with a policy override. See [Policy Resolution](https://docs.safedep.io/concepts/policy-resolution.md).

## What enforces each part

| Part of the policy | PMG | Pull request check | Vet |
| - | - | - | - |
| Block entries | Enforces | Enforces | Not yet |
| Trust entries, scope `malware` | Enforces | Enforces | Not yet |
| Trust entries, scope `cooldown` | Enforces | Not supported | Not yet |
| Trust entries, scope `vulnerability` | Not applicable | Enforces | Not yet |
| Dependency cooldown (`package_admission.cooldown.min_age`) | Enforces | Not supported | Not yet |
| Scan gate (`scan_gate.fail_on`, `scan_gate.fail_on_attacks`) | Not applicable | Enforces, with exceptions | Not yet |

The [settings reference](https://docs.safedep.io/reference/cloud-policy-settings.md) gives the exceptions of each setting.

## Who can change the policy

A user with the ReadOnly role or a higher role can read the policy, its revisions and its decisions. Only an Admin can create, edit, publish or delete a policy change, create or change a package rule, or set a label. Only an Admin can read the audit events.

## How a change reaches the tools

1. An Admin edits the policy with `safedep policy edit`. The edit makes a draft, a policy change.
2. The Admin reads the preview with `safedep policy change show`.
3. The Admin publishes the change. The publish makes a new policy revision.
4. The next pull request check of each project uses the new revision. PMG on each endpoint applies it after its next policy fetch.

A package rule skips the draft: `safedep policy rule create` publishes at once. See [Policy Revisions and Changes](https://docs.safedep.io/concepts/policy-revisions.md).

## Set up the tools

> [card] [Apply the cloud policy in PMG](https://docs.safedep.io/package-security/pmg/cloud-policy.md)
>
> Turn on `cloud.policy` in PMG on developer machines and CI runners.

> [card] [Pull request checks](https://docs.safedep.io/governance/cloud/policy/pull-request-checks.md)
>
> Use the policy in the GitHub App and the Bitbucket app.

## Guides

> [card] [Quickstart](https://docs.safedep.io/governance/cloud/policy/quickstart.md)
>
> Publish your first policy with the safedep CLI.

> [card] [Block a Package](https://docs.safedep.io/governance/cloud/policy/block-a-package.md)
>
> Block a package for the whole tenant during an incident.

> [card] [Trust a Package](https://docs.safedep.io/governance/cloud/policy/trust-a-package.md)
>
> Trust a package after a false positive.

> [card] [Set a Cooldown](https://docs.safedep.io/governance/cloud/policy/set-a-cooldown.md)
>
> Set the dependency cooldown for the tenant or for a group.

> [card] [Target a Group](https://docs.safedep.io/governance/cloud/policy/target-a-group.md)
>
> Label endpoints and projects and write a policy override.

> [card] [Fail Pull Request Checks](https://docs.safedep.io/governance/cloud/policy/pull-request-checks.md)
>
> Choose the severities that fail a check for a group of projects.

> [card] [Roll Back a Change](https://docs.safedep.io/governance/cloud/policy/roll-back-a-change.md)
>
> Restore a setting from an old revision.

> [card] [Explain a Decision](https://docs.safedep.io/governance/cloud/policy/explain-a-decision.md)
>
> Find the rule or setting that blocked a package or failed a check.

> [card] [Audit Policy Changes](https://docs.safedep.io/governance/cloud/policy/audit-policy-changes.md)
>
> See who changed the policy, and when.

## Reference

> [card] [Cloud Policy Settings](https://docs.safedep.io/reference/cloud-policy-settings.md)
>
> Each setting, its type and its default.

> [card] [Cloud Policy Limits](https://docs.safedep.io/reference/cloud-policy-limits.md)
>
> Limits, retention and known gaps.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.