What is the nature and description of the request?

Customer needs to be able to disable allowing policies which are externally managed to be modified outside of the CR workflow (no changes/deletes via UI or directly via API calls). The default could remain to allow drift, but with a way to configure the ACS central instance to disallow it.

Why does the customer need this? (List the business requirements here)

Customer has workflow that allows for editing other configurations managed as code via UI (for example, ACM policies) in their dev clusters, but not in their staging or production clusters. They would like to apply the same constraint when they start managing ACS policies as code.

List any affected packages or components.

• ACS Central
• ACS config-controller
• ACS UI