writing-rego-rules

Start every rule with package rule and import rego.v1, then define a pass rule using the if keyword. Read evidence from input.detail.* and policy values from data.*, following one of the five canonical patterns such as threshold or freshness checks.

Fianu controls require OPA v1 syntax, enabled by the import rego.v1 directive. This mandates the if keyword for every rule body and every for quantifiers; rules written in v0 syntax are not accepted.

Evidence from the subscribed plugin arrives under input.detail.*, while policy values from the control's policy template appear under data.*. Every key in the policy template must correspond to a data.* reference in the rule, or evaluation silently fails.

The most common cause is a mismatch between policy template keys and the data.* paths referenced in the rule, which fails silently at evaluation time. Verify schema alignment by running plugin schema discovery and checking every template key against the rule.

Use the multi-metric pattern when one control must evaluate several measurements at once, such as critical, high, medium, and low vulnerability counts each staying under its own policy maximum. The rule passes only when all sub-checks pass.