A hands-on walkthrough shows how to use Octopus Deploy's Platform Hub to define and enforce Open Policy Agent (OPA) policies written in Rego. The guide creates a policy requiring a Self-Support process template to exist in all deployment projects, covering both Scope Rego (which projects the policy applies to) and Conditions Rego (the policy logic itself). It demonstrates publishing the policy in warning mode to identify non-compliant projects via the audit log without disrupting deployments, then switching the Violation Action to Block to enforce compliance and fail non-conforming deployments. The piece closes with notes on setting up subscriptions for notifications and moving the policy into a real Git repository.
Table of contents
PrerequisitesCreating the projectCreating the policyPublishing a policyDiscovering non-compliant deploymentsBlocking deploymentsWhat just happenedNext stepsTags:Questions this post answers
How do I write an Open Policy Agent policy in Octopus Deploy to require a specific process template on every deployment?
Write a Conditions Rego policy that defaults to denying deployments, then allows them only when a step's Source.Type equals "Process Template" and step.Source.SlugOrId matches the template's slug, the step is not in SkippedSteps, and step.Enabled is true. Pair it with a Scope Rego block that limits which spaces or environments the policy applies to, for example matching input.Space.Id to a specific space. Teams standardizing deployment governance can track Octopus Platform Hub policy patterns like this on daily.dev.
How can I test a new deployment policy in Octopus Deploy without breaking existing deployments?
Set the policy's Violation Action to Warning instead of Block before publishing it. Non-compliant deployments will still succeed, but the audit log records a warning under the event category "Compliance Policy evaluated as non-compliant with warning outcome," letting you identify which projects need fixes before switching the action to Block and enforcing it. Anyone rolling out compliance rules gradually can follow deployment governance workflows like this on daily.dev.