Rules and policy
Signals Corps manages the Supply Chain rule catalog. Each Workspace applies a trusted policy profile to decide which rule matches generate alerts and which can block.
Managed rules
Section titled “Managed rules”A rule has a stable ATR-YYYY-NNNNN identifier, severity, category, customer-safe description, lifecycle status, and optional knowledge-base mappings. Rule definitions are read-only in the MVP.
Rule lifecycle status describes the rule definition:
- Draft: still being prepared and not part of ordinary released coverage.
- Experimental: available with limited maturity.
- Stable: part of supported released coverage.
- Deprecated: retained for history but scheduled to leave active coverage.
Workspace occurrence counts show how often a rule produced findings in that Workspace. They never include another Workspace’s results.
Policy profiles
Section titled “Policy profiles”The current Supply Chain profiles are Essential and Recommended. The Workspace’s effective plan chooses the available profile, alert coverage, and whether automated blocking is active.
- Essential is the Free profile. It exposes 106 stable, high-confidence rules and reports every match as an alert without automated blocking.
- Recommended is the Team, Scale, Enterprise, and Team-trial profile. It exposes 740 live rules. High or Critical matches from the same 106-rule stable subset can block; the other 634 rules remain alert-only.
Policy is stored in Signals Corps, outside the source being inspected. A pull request, archive, or pasted file cannot weaken the policy used to assess itself.
Read Protect pull requests with GitHub checks to map these managed outcomes to GitHub merge protection.