Stop risk before it enters your software supply chain.

Cloudsmith enforces policy at the repository, the one place every developer, pipeline and AI agent pulls from. Policy is written as code with OPA Rego and applies from ingestion through production, so you govern how software enters your environment at the speed AI agents work.

One place to enforce policy

Set your rules at the repository: a CVE threshold, a license restriction, a cooldown period, a deny list. They cascade to every pipeline and developer that pulls from them. One control point instead of policy scattered across pipelines, written in OPA Rego so rules stay precise, version-controlled, and auditable.

Policy management with Cloudsmith

Enforce your security policies continuously

Continuous evaluation - Evaluate packages for policy enforcement on upload, policy change, and when intelligence updates.

Threat prevention - Block malicious packages before they reach your developers and pipelines, using exploit context and EPSS scores.

Unified policy enforcement - Apply the same policies to packages pulled by AI coding tools and agents, including typosquatted and hallucinated packages agents install without review.

Start with a strong enforcement baseline

Build a baseline - Establish an enforcement baseline with standard policies covering CVEs, malicious packages, licenses, and deny lists.

Start with templates - Deploy pre-built policy templates for common risk scenarios so you're not writing rules from scratch.

Customize policies - Extend and customize your policies as your requirements grow with policy-as-code.

Stop attacks that hide in newly published packages

Cooldown policies - Withhold newly published package versions from package managers until they reach a minimum age.

Serve the latest compliant version - Enforce at the index, not the cache, so builds resolve automatically.

Quarantine in-use packages - Quarantine already-cached packages and release them automatically once they clear the window.

Govern open source license use

License detection - Detect and act on copyleft licenses across your repositories.

Container license scanning - Discover unwanted licenses in transitive dependencies inside container images.

AI license enforcement - Apply the same license rules to packages chosen by AI agents.

Keep developers in the flow

Custom remediation - Simplify remediation with customizable error messages to native package managers when a package fails policy.

Policy allowlists - Manage exemptions as allowlist policies in your existing GitOps workflow.

Enforcement modes - Balance security and availability by choosing to hold packages until policy is enforced or delivering on first request and then running enforcement.

Audit every policy decision

Decision history - Get a clear record of what was quarantined, flagged, or allowed, when it happened, and against which policy.

Decision logs - Use decision logs for compliance reviews, incident investigation, and ongoing policy refinement.

Let AI agents move fast, with every dependency governed

AI agents choose and install dependencies faster than any team can review. Cloudsmith is the software supply chain for AI-enabled development: point agents and package managers at Cloudsmith, and every request is proxied, checked against your policies, and only then served.

One trusted source for every agent request

Single point of control - Route dependencies demanded by AI agents and developers through Cloudsmith, instead of letting them reach public registries directly.

Upstream proxying - Proxy open source registries through upstreams, so policy and checks apply before any package, container or model is made available.

Visibility - See what agents pull, with logs and observability across every request.

A dependency firewall for what agents install

Guardrails in Rego - Define what can and cannot flow to agents: quarantine or block packages above a CVE threshold, and hold prohibited licenses for inspection.

Cooldown windows - Hold very new package versions for a set period before they are released to agents and developers.

Quality tagging - Tag poorly maintained packages so they are visible before they reach production.

Give agents the context your teams already built

Organizational memory - Agents draw dependencies from pre-cached, pre-described registries that record what is publicly known about each package.

Better choices - Policy status, license suitability and preferred options travel with the metadata, so agents favor approved dependencies over bespoke code.

Lower maintenance - More uniform software that is easier to maintain and ships to production with less rework.

Frequently Asked Questions

1. How does policy management help us manage open source risk?

Most of your dependencies come from open source registries you do not control. Policy management evaluates every package at the point of entry, covering vulnerabilities, malware, licenses and deny lists, so risky packages are quarantined before they reach developers, pipelines or production.

2. How does policy management protect us when AI agents install packages?

Point your AI agents and developer package managers at Cloudsmith, and every dependency they request flows through your repositories. Cloudsmith proxies open source requests through upstreams and applies your Rego policies before anything is served. Vulnerable packages can be quarantined or blocked, prohibited licenses held for inspection, and very new versions held back with a cooldown window. Every decision is logged, so you keep clarity over what agents pull without slowing them down.

3. Will policy management slow down developer workflows?

No. Policy management is built so security does not become a bottleneck. Actions are proportionate to the risk: notify, tag or quarantine. Because deep artifact data is available to policies, decisions are automated and developers get clear, immediate feedback from their package manager.

4. Can policies adapt to our specific compliance needs?

Yes. Policies are written as code in OPA Rego, so you tailor enforcement to your own compliance requirements. Cloudsmith gives every policy evaluation the package metadata and security intelligence it needs, so rules can change quickly as threats, regulations or internal standards evolve.

5. What visibility do we get into policy decisions?

Every policy evaluation and its outcome is captured in a decision log, including why the decision was made and which action was taken. Security teams can see what was allowed, quarantined or tagged, and use the records for audits, incident investigation and policy refinement.

6. Is policy management limited to open source packages?

No. Policies apply to artifacts across formats, from containers to language packages, and can act on vulnerabilities, licenses or custom metadata, anywhere in your software supply chain.

7. How does policy management stay effective against new and emerging threats?

Policies are evaluated continuously. Cloudsmith re-evaluates packages when they are added or copied, when a scan runs, and when new data arrives, such as updated CVSS or EPSS scores. Your protections keep pace as threats change.

8. Who benefits most from policy management, DevOps teams or security teams?

Both. DevOps and platform teams get automated enforcement that keeps developers moving, and security teams get the governance and visibility they need across the supply chain.

9. Is it possible to implement policies globally or only to specific teams?

You control the scope. Policy management allows you to implement policies at the org level, team level, repository level, or even workflow level. That flexibility makes it easy to impose global rules without compromising on team-specific requirements or experimental environments.

10. What are cooldown policies and how do they protect against supply chain attacks?

Cooldown policies hold newly published package versions until they reach a minimum age. Many attacks depend on a malicious version being pulled immediately after publication, before the community or threat intelligence has flagged it. With a cooldown window, only versions with an established history enter your supply chain.

11. Can cooldown policies be applied selectively, without blocking legitimate fast-moving dependencies?

Yes. Cooldown policies are configurable by scope, so you can apply stricter windows to high-risk ecosystems or repositories while leaving others unaffected.