Policy schema

Every field accepted in a ztvs.policy.yaml file.

Top level#

Field Type Required Description
version integer yes Schema version. Currently 1.
suppress list of rules no Findings to suppress
enforce object no Conditions that fail the run

suppress[]#

Field Type Required Description
where matcher yes What this rule applies to
reason string yes Why. Free text, retained in the report.
review_by date yes After this date the rule stops applying

A rule missing reason or review_by is a parse error, not a warning.

Matchers#

Matcher Operators Example
advisory exact, list advisory: ZTVS-2026-0044
package.name exact name: openssl
package.version below, at_least, exactly version: { below: 0.10.66 }
severity at_most, at_least severity: { at_most: medium }
layer_index below, exactly layer_index: { below: 3 }
path glob path: "vendor/**"

Matchers within one where are and-ed. Separate rules are or-ed.

enforce#

Field Type Default Description
fail_on.severity.at_least severity — Fail at or above this severity
fail_on.unsuppressed_only boolean true Whether suppressed findings count
fail_on.expired_suppressions boolean true Fail if any rule has expired

Worked example#

version: 1

suppress:
  - where:
      advisory: ZTVS-2026-0044
    reason: "Vulnerable codec path is never constructed — see ADR-0031"
    review_by: 2026-11-30

  - where:
      layer_index: { below: 3 }
    reason: "Base image, patched on the platform team's cadence"
    review_by: 2026-12-01

enforce:
  fail_on:
    severity: { at_least: high }
    unsuppressed_only: true
    expired_suppressions: true