CDE Governance and Policies

Define clear roles with specific permissions and responsibilities. Common roles include:

• Developer: Create and manage own workspaces, standard resource limits
• Team Lead: Manage team workspaces, approve resource requests, view team usage
• Platform Admin: Manage templates, configure policies, view all workspaces
• Security Admin: Audit logs, enforce security policies, manage compliance
• AI Agent: API-only access, scoped to assigned repositories, time-limited sessions
• Read-Only: View dashboards and reports, no workspace creation

Document permissions for each role across actions and resources:

Implement approval processes for sensitive or resource-intensive requests:

• GPU Access: Request with justification - Manager approval - Auto-expiry after 7 days
• Production Access: Just-in-time request - Security team approval - Time-limited token - Audit log
• Agent Elevation: Agent requests expanded permissions - Team lead approval - Scoped to specific task - Auto-revoke on completion
• Large Resources: Workspaces >64 vCPU require team lead approval and business justification

Maintain a catalog of vetted, security-hardened base images for common development scenarios including agent-specific images.

• Vulnerability-scanned and patched
• Compliance controls pre-configured
• Standard tooling and dependencies
• Agent-optimized minimal images available
• Version pinning for reproducibility

Embed mandatory security tooling into all templates to prevent configuration drift and ensure consistent protection.

• Secret scanning (git-secrets, truffleHog)
• Dependency scanning (Snyk, Dependabot)
• Static analysis (SonarQube, Semgrep)
• Audit logging agents
• LLM proxy for API traffic inspection

Enforce organizational standards through template configurations that cannot be overridden by individual developers or agents.

• Network policies and firewall rules
• TLS certificates and encryption settings
• Git configuration (signed commits)
• LLM provider allowlist and API routing
• Logging and monitoring agents

Open Policy Agent (OPA) provides a declarative policy language (Rego) for expressing complex rules that can be enforced across your CDE platform, including AI agent-specific constraints.

package workspace.admission

deny[msg] {
    input.request.kind.kind == "Workspace"
    not input.request.object.spec.template.approved
    msg := "Workspace must use approved template"
}

deny[msg] {
    input.request.kind.kind == "Workspace"
    input.request.object.spec.agent == true
    not input.request.object.spec.network.egressAllowlist
    msg := "Agent workspaces require explicit egress allowlist"
}

deny[msg] {
    input.request.kind.kind == "Workspace"
    cpu := input.request.object.spec.resources.cpu
    cpu > 32
    not is_admin
    msg := "CPU limit exceeds maximum (32) for non-admins"
}

OPA policies can validate workspace configurations, enforce resource limits, check compliance requirements, restrict agent permissions, and integrate with admission controllers to prevent non-compliant deployments.

Integrate policy engines into CDE infrastructure to automatically enforce governance without manual intervention - essential when AI agents operate at machine speed.