Elderly Quail- Thank you for asking this question,

Yes, you can use OPA policies in Harness to restrict what steps or stages users can add into an Insert Stage or Step

For example, using Rego policies, you can define a list of allowed step types and block any that don't match. Here's a sample policy that denies steps in an insert block unless they are one of the approved scanners (e.g., , ):

package pipeline

deny[msg] {

step = input.pipeline.stages[i].stage.template.templateInputs.spec.execution.steps[_].insert.steps[_].parallel[_].step

not contains(allowed_scanners, step.type)

msg := sprintf("Step type %s is not part of the allowed scanners %s", [step.type, allowed_scanners])

}

deny[msg] {

step = input.pipeline.stages[i].stage.template.templateInputs.spec.execution.steps[_].insert.steps[_].step

not contains(allowed_scanners, step.type)

msg := sprintf("Step type %s is not part of the allowed scanners %s", [step.type, allowed_scanners])

}

allowed_scanners = ["Snyk", "Sonarqube"]

contains(arr, elem) {

arr[_] = elem

}

You can tailor this logic as per your requirement.

Let us know if you’d like help writing a policy specific to your use case.