<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Security Guardrails — API Reference

## OPA CLI

```bash
# Evaluate policy
opa eval --data policy/ --input plan.json "data.terraform.deny"

# Evaluate with raw output
opa eval --data policy/ --input plan.json --format raw "data.terraform.deny"

# Test policies
opa test policy/ -v

# Check policy syntax
opa check policy/

# Format policy files
opa fmt --write policy/
```

## Conftest CLI

```bash
# Test Terraform plan
conftest test plan.json --policy policy/

# Test Kubernetes manifest
conftest test deployment.yaml --policy policy/k8s/

# Test Dockerfile
conftest test Dockerfile --policy policy/docker/

# Multiple namespaces
conftest test plan.json --namespace terraform --namespace security

# Output format
conftest test plan.json --output json
```

## Kyverno CLI

```bash
# Apply policy to resource
kyverno apply policy.yaml --resource deployment.yaml

# Test policy
kyverno test .

# Validate policy
kyverno validate policy.yaml
```

## Guardrail Classification

| Type | Action | Use Case |
|------|--------|----------|
| Hard guardrail | Block deployment | No public S3, no privileged containers |
| Soft guardrail | Warn only | Enable monitoring, add tags |
| Exception | Documented bypass | Time-limited with approval |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All guardrails pass |
| 1 | Hard guardrail violations |
| 2 | Policy evaluation error |
