Priority: P1 / High

Module: Platform, Governance (Policy as Code), Delegates, RBAC

Type: Feature request / product gap

Account: jLOlhyHHQ0yh8snNBDPL0A (paypal.harness.io)

Problem

We publish certified account-level golden templates. App teams cherry-pick stages from them, rename them, inline the YAML, or skip templates entirely. Some even use a production connector or delegate inside a “pre-prod” stage. We let teams experiment freely in lower environments. Anything that promotes or deploys to higher or production environments must come from a certified template. Harness gives us no way to enforce this.

Requirement

Restrict specific connectors and delegates (our prod and higher-env ones) to:

stages or pipelines built from approved templates (templateRef + versionLabel), or

an allow-list of orgs, projects or pipelines,

with a Warn mode first and an Error/Block mode after.

Current gaps

Connector OPA runs On Save only. Nothing fires when a connector is used.

Delegates aren’t an OPA entity. There’s no hook w