Configure CircleCI's configuration policies (config-policy-management) to enforce organizational standards on pipeline YAML using OPA Rego policies evaluated server-side

Steps

1. Enable config policies for the CircleCI organization in the Organization Settings UI or via the CircleCI CLI; policies are evaluated on the server against every pipeline config before the pipeline starts
2. Write a Rego policy file that imports data.circleci.config and defines a hard_fail set containing violation messages when pipeline config violates organizational rules such as missing resource_class constraints or using deprecated executors
3. Push the policy to CircleCI using circleci policy push ./policies --owner-id <org-id>; the CLI validates the Rego syntax and uploads the policy bundle to CircleCI's policy service
4. Test the policy locally using circleci policy eval --input pipeline-config.yml --owner-id <org-id> to simulate server-side evaluation and confirm violation messages match expectations before pushing
5. Add a soft_fail decision set alongside hard_fail so policy violations that should warn without blocking can surface as annotations on the pipeline without stopping execution
6. Version control the policy repository separately from application code and set up a CI pipeline on the policy repo that runs circleci policy eval against a corpus of known-good and known-bad config fixtures to catch policy regressions