Create Policies

Curation is based on a set of defined policies. To create a new curation policy, the Curation Admin must choose the remote repositories to which the policy applies, the policy condition (only 1 condition can be defined for each policy), and the action to be performed when the policy is violated. In addition, any exceptions to the policy can be defined in a waiver.

Do the following:

1. Go to Administration > Curation > Policies Management.
2. Click Create Policy and follow the wizard:
   • Step 1: Enter a name for the policy (max 50 characters, no special symbols).
   • Step 2: Define the scope:
     • Organization-wide: Applies to all curated repositories. You can optionally exclude specific repositories or groups.
     • Specific remote repositories: Select one or more curated remote repositories or package types to enforce the policy on.
     • Selected groups: Enforce the policy only on selected JFrog Platform Access groups. Requires Enforce policy on cached packages to be enabled.
   • Step 3: Choose a condition from the predefined or custom options.
     For a full detailed list of the conditions, see here.
     Examples:
     • Block based on CVSS score thresholds.
     • Block non-official Docker images.
     • Block packages not labeled as "allowed."
     • Block package versions that have reached End of Life (EOL).
     • Block or allow packages based on custom licenses from JFrog Catalog. For a step-by-step guide, see How to Create Curation Policies for Custom Licenses.
   • Step 4 (optional): Add waivers to exclude specific packages or versions.
   • Step 5: Define the action as Block or Dry Run, set the behaviors for packages whose data is pending, and configure email notifications. The pending behaviors are Block for pending packages and Block for on demand pending packages.
   • Step 6 (optional): Enable Share with Federation to propagate this policy to all connected follower Instances via Curation Federation. This option is available only for policies with scope All Curated or Package Types. Share with Federation requires Curation Federation to be enabled on your platform.
     Learn more here.

Pending Catalog Update Behavior

A package that the JFrog Public Catalog hasn't ingested yet is in a Pending Catalog Update state. A package that is waiting for an On-Demand Curation scan is in a pending on-demand state. Each policy decides on its own whether to block or skip a package in these states.

In Step 5 of the wizard, under Pending Catalog update, select or clear the following independent checkboxes. Each one covers a different pending state, so selecting one doesn't affect the other.

• Selected: The policy blocks the package while its data is pending.
• Cleared: The policy is skipped while the data is pending, and the package is still evaluated against your other policies.

Only a block on a package pending a Catalog update can be waived. For more information, see Manage Waivers.

How Pending Packages Are Evaluated

Each policy is evaluated independently. If one policy blocks a pending package and another skips it, the package is blocked only by the blocking policy. When the package is pending Catalog analysis, a waiver request is routed to the decision owners of that blocking policy.

Migration from Global Setting

This per-policy behavior replaces the platform-wide Resolution of Pending Package Updates setting. Existing policies are migrated automatically.

Dry Run policies are migrated with both options cleared.

Policy Scope Options

When creating a policy, you choose how broadly or narrowly it should be applied. The available scope options are:

Apply Policy to a Group of Users

Curation supports scoping policies by JFrog Platform Access Groups, enabling organizations to apply different policy behaviors to different teams or user segments even when they share the same repositories.

How It Works

When a user requests to download a package, Curation resolves the user's Access group memberships and evaluates whether the policy applies:

• Selected groups (include): The policy is enforced only for users who belong to at least one of the selected groups. Users outside those groups are not affected.
• Excluded groups: When using the Organization-wide scope, you can exclude specific groups. Users belonging to an excluded group are exempt from the policy, even if it would otherwise apply.

If a user belongs to both an included and an excluded group, the exclusion takes precedence and the policy is not enforced for that user.

When to Use Group-Based Scope

Group-based scoping is useful when a single repository serves multiple teams with different security requirements. For example:

Configuration

1. Go to Administration > Curation > Policies Management.
2. Click Create Policy.
3. In the Scope step, select Selected groups.
4. Choose one or more Access groups from the group selection modal.
5. Continue with the remaining policy wizard steps (condition, waivers, actions).

To exclude groups from an Organization-wide policy:

1. In the Scope step, select Organization-wide.
2. Click Exclude Groups and select the groups to exempt.