Each policy instance will be split into rules and behavior.   Behavior includes:  User defined exclusions, Scope, Notifiers, Enforcement actions for the scope. A policy instance can be enabled/disabled.{}

Rules + default exclusions come from a template - which can be reused across policy instances. Users may add their own user specific behavior to an instance.{}

Default Policy Templates

A default policy template is a read only object that contains the policy metadata that a user cannot edit/change. Their lifecycle is managed solely by RHACS - a user cannot perform CRUD operations on default policy templates.{}

They will be read only - and overwritten on upgrade. They will ship with default, system defined exclusions which are also not user editable. (in the future we could consider templating this).{}

Policy instances from default templates will be created on user request when Central is first deployed. A user can then add their own behavior to the instance.

ACCEPTANCE CRITERIA

• tbd

QUESTIONS

• -

REFERENCES

• https://docs.google.com/document/d/1W65R2jn3nfC-IwVWNzsIpdmP8NdFi2kFVKTUkGBQoS0/edit?usp=sharing