1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# evaluate.rego — Policy evaluation entrypoint ================================
#
# Aggregates deny and warn rules across all control packages via walk().
# Automatically discovers new controls without manual registration.
# Query: data.evaluate.deny[_].summary

package evaluate

# Aggregate all deny violations across controls --------------------------------

deny contains msg if {
	walk(data.controls, [path, value])
	path[count(path) - 1] == "deny"
	msg := value[_]
	is_object(msg)
}

# Aggregate all warn violations across controls --------------------------------

warn contains msg if {
	walk(data.controls, [path, value])
	path[count(path) - 1] == "warn"
	msg := value[_]
	is_object(msg)
}