1. Docs
  2. Insights & Governance
  3. Policy
  4. Policy Packs
  5. Policy Metadata

Policy Metadata

    Each policy includes metadata that defines its identity, purpose, and behavior. Metadata provides important context for how a policy is displayed, enforced, and remediated. This information helps both authors and users understand what the policy does, how severe its violations are, and how to resolve them.

    The table below describes all supported metadata fields and their usage:

    FieldRequiredDescription
    nameYesUnique identifier for the policy within the policy pack.
    descriptionYesShort summary of what the policy checks or enforces.
    enforcementLevelNoDefines how the policy behaves on violation. Options: advisory (warn only), mandatory (block deployment), remediate (auto-fix violations), or disabled (turn off policy).
    severityNoIndicates the seriousness of violations. Valid values: low, medium, high, critical.
    displayNameNoHuman-readable name for the policy (used for display instead of name).
    remediationStepsNoGuidance for how to fix a violation or bring a resource into compliance.
    urlNoLink to external documentation, references, or remediation guides.
    tagsNoArray of labels or categories for grouping and filtering policies.
    frameworkNoAssociates the policy with a compliance framework or standard.
    framework.nameYes*Name of the compliance framework (e.g., "PCI-DSS", "HIPAA", "SOC 2").
    framework.versionYes*Framework version (e.g., "3.2.1", "2022").
    framework.referenceYes*Specific control or requirement reference within the framework.
    framework.specificationYes*Detailed description of the related compliance requirement.
    configSchemaNoSchema defining user-configurable parameters for the policy. For more information on configSchema, see authoring
    configSchema.propertiesYes*Object describing available configuration options and their types.
    configSchema.requiredNoArray of property names that must be supplied when configuring the policy.

    * Required if the parent field is defined.

      Neo just got smarter about infrastructure policy automation