Policies & Evaluations

In JFrog AppTrust, lifecycle policies are governance controls that define how a software resource such as software version is allowed to go through operations such as a promotion in the SDLC or a move to a new location. This page describes the basic concepts relating to policies and how AppTrust uses them to automate governance and compliance in your SDLC.

Policies

A policy consists of the combination of a scope, an operation type, a rule, and an action. For a detailed discussion of policies and definitions of these elements, see Policies.

Evaluations

Each policy is evaluated automatically when a resource, such as an application version, must pass an operation—such as Dev|Exit, QA|Entry, or Copy—to determine whether the operation can proceed. When an evaluation passes, the operation can take place. When a policy evaluation fails, AppTrust takes the action you defined in the policy, either Fail or Warn.

AppTrust maintains a log of all evaluation events that you can view. If an operation fails, you can check the evaluations to find exactly which policy (or policies) caused the failure. For more information, see Evaluations.

Waivers

If a policy violation is causing delays, AppTrust enables a system of waivers. You can request a waiver, and it must be approved in your organization to become effective. For more information about waivers, see Waivers.

Relationship to Evidence

Evidence plays a central role in lifecycle policy enforcement. Many rules rely on the presence of specific evidence—such as a signed SBOM, a build provenance, or a change approval—to determine compliance.

When an operation is initiated, AppTrust verifies that the required evidence is attached to the evaluated resource. If the required evidence is missing, a policy violation is triggered. Together, lifecycle policies and evidence create an auditable framework for validating trust, security, and compliance throughout the SDLC.

Roles and Actions Required

To use the lifecycle policies in AppTrust, you need one of the following Actions defined in a Global or a Project Role in JFrog Platform:

• Read AppTrust Policy: Allows you to read policy information
• Manage AppTrust Policy: Allows you to create, view, edit, and delete AppTrust policies

For information about setting up the Roles and Actions for users, see Manage Project Roles and Members. A Platform Administrator is required to set up the Roles and Actions.