Rego Playground

Validating Rego

Before adding a policy, check that it compiles and has the correct structure:

POST /policy-sets/validate-rego
{
  "rego_source": "package forgecroft.policy\n\ndeny[msg] { msg := \"test\" }"
}

Response on success:

{ "valid": true }

Response on failure:

{ "valid": false, "error": "..." }

The validator checks:

1. Rego compiles without syntax errors
2. package forgecroft.policy exists
3. At least one of deny or require_approval rules is present
4. deny returns an array of strings
5. require_approval returns an array of objects

Timeout: 5 seconds.

Evaluating Rego

Test a policy against custom input to see what it would produce:

POST /policy-sets/evaluate-rego
{
  "rego_source": "package forgecroft.policy\n\ndeny[msg] { input.workspace.attributes.environment == \"production\"; msg := \"prod\" }",
  "input": {
    "workspace": {
      "attributes": { "environment": "production" }
    }
  }
}

Response:

{
  "deny": ["prod"],
  "require_approval": []
}

The evaluation runs under fake IDs ("playground") with a 10-second timeout.

Testing require_approval

POST /policy-sets/evaluate-rego
{
  "rego_source": "package forgecroft.policy\n\nrequire_approval[r] { input.workspace.attributes.environment == \"production\"; r := {\"team\": \"platform\", \"min\": 1, \"stage\": 1, \"reason\": \"test\", \"timeout_hours\": 0} }",
  "input": {
    "workspace": {
      "attributes": { "environment": "production" }
    }
  }
}

Response:

{
  "deny": [],
  "require_approval": [
    {
      "team": "platform",
      "min": 1,
      "stage": 1,
      "reason": "test",
      "timeout_hours": 0
    }
  ]
}

Workflow

1. Write your Rego policy
2. Validate it with POST /policy-sets/validate-rego
3. Evaluate it with POST /policy-sets/evaluate-rego using test input
4. Iterate until the output matches expectations
5. Add the policy to a policy set with POST /policy-sets/{id}/policies

Related

• Writing Rego — Policy structure and examples
• Policy Sets — Adding policies to sets