endor-policy

name	endor-policy
description	Create and manage Endor Labs security policies for automated enforcement. Use when the user says "create a policy", "block critical vulns", "endor policy", "security gate", "enforcement rules", "exception policy", or wants to define rules for blocking PRs, requiring reviews, or enforcing security standards. Do NOT use for one-time PR review (/endor-review) or viewing findings (/endor-findings).

Endor Labs Policy Management

Create and manage security policies. Requires admin access to the namespace.

Confirm before creating or modifying policies. Policy changes affect enforcement for the entire namespace — a "block critical" policy could block all PRs across the org. Always show the user the exact policy filter and action before executing create/update/delete operations.

Policy Types

Type	Purpose
Finding Policy	Define what security issues to flag or block
Exception Policy	Create exceptions for accepted risks
Action Policy	Automate responses (block PR, notify, create ticket)

Templates

Template	Description
block-critical-reachable	Block PRs with critical reachable vulns
license-compliance	Block copyleft licenses in commercial projects
no-secrets	Block any committed secrets
sast-required	Require SAST scan pass before merge
sbom-required	Require SBOM generation on release
dependency-age	Warn on stale dependencies
max-severity	Block findings above severity threshold

Workflow

List Policies

npx -y endorctl api list --resource FindingPolicy -n $ENDOR_NAMESPACE 2>/dev/null

Create Policy

block-critical-reachable

npx -y endorctl api create --resource FindingPolicy -n $ENDOR_NAMESPACE 2>/dev/null --data '{
  "meta": { "name": "block-critical-reachable", "description": "Block PRs with critical reachable vulnerabilities" },
  "spec": { "finding_policy": { "type": "FINDING_POLICY_TYPE_BLOCK", "filter": "spec.level==FINDING_LEVEL_CRITICAL and spec.finding_tags contains FINDING_TAGS_REACHABLE_FUNCTION" } }
}'

license-compliance

npx -y endorctl api create --resource FindingPolicy -n $ENDOR_NAMESPACE 2>/dev/null --data '{
  "meta": { "name": "license-compliance", "description": "Block strong copyleft licenses" },
  "spec": { "finding_policy": { "type": "FINDING_POLICY_TYPE_BLOCK", "filter": "spec.finding_categories contains FINDING_CATEGORY_LICENSE_RISK and spec.level in [FINDING_LEVEL_CRITICAL, FINDING_LEVEL_HIGH]" } }
}'

no-secrets

npx -y endorctl api create --resource FindingPolicy -n $ENDOR_NAMESPACE 2>/dev/null --data '{
  "meta": { "name": "no-secrets", "description": "Block any exposed secrets" },
  "spec": { "finding_policy": { "type": "FINDING_POLICY_TYPE_BLOCK", "filter": "spec.finding_categories contains FINDING_CATEGORY_SECRETS" } }
}'

max-severity

Ask user for the maximum allowed severity, then build filter accordingly.

Custom Policy

Help user build filter using /endor-findings filter reference.

Create Exception

npx -y endorctl api create --resource ExceptionPolicy -n $ENDOR_NAMESPACE 2>/dev/null --data '{
  "meta": { "name": "exception-{finding-id}", "description": "{reason}" },
  "spec": { "exception_policy": { "finding_uuid": "{uuid}", "expiration": "{ISO-8601}", "justification": "{justification}" } }
}'

Present Results

After creating/listing policies:

## Policy Created

**Name:** {name} | **Type:** {type} | **Action:** {action} | **Status:** Active

### Filter
{Human-readable description}

### Next Steps
1. Push a test commit to verify enforcement
2. `/endor-cicd` — Integrate with pipeline
3. `/endor-policy list` — View all policies

For data source policy, read references/data-sources.md.

Error Handling

Error	Action
Insufficient permissions	Contact namespace admin
Policy already exists	Offer to update or rename
Invalid filter	Help fix syntax
Auth error	Suggest /endor-setup

Related

• /endor-validate-policy — Test whether a policy matches findings in a project before enforcing it