Harness "Policy ... rejected" (OPA governance) in CI

By Kaveh Alemi·Latchkey

Harness Policy As Code evaluates OPA/Rego policy sets against pipelines at defined enforcement points. A rejection means a policy returned a deny for the pipeline, so the run is blocked until the pipeline complies or the policy is adjusted.

What this error means

A pipeline save or run fails with "Policy evaluation failed" listing the denied rule, such as a required approval, an allowed-registry rule, or a naming standard.

Policy Set 'deployment-guardrails' rejected the pipeline:
deny: pipeline must contain an Approval step before Production deployment.

Common causes

The pipeline violates a governance rule

An OPA policy (required approval, allowed registries, naming) evaluated the pipeline and returned deny.

The policy is enforced at save or run

The policy set is bound to an enforcement point (on save or on run) that blocks non-compliant pipelines.

How to fix it

Make the pipeline compliant

1. Read the specific deny message from the policy evaluation.
2. Adjust the pipeline to satisfy the rule (add approval, use allowed registry).
3. Re-save or re-run once it complies.

Adjust the policy if the rule is wrong

If the policy itself is too strict or misconfigured, update the Rego rule or the policy set binding with governance owner approval.

How to prevent it

• Design pipelines to meet governance policies from the start.
• Test policy sets in warn mode before enforcing them.
• Document policy rules so pipeline authors comply.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation