> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement.md).
# Enforcement
Prisma Cloud provides default parameters for each code category scanned in your repositories, based on best practices. Through Enforcement, you can efficiently manage enforcement strategies across your code reviews by customizing how violations, failures and comments are handled before repositories are scanned or integrated. This capability helps reduce unnecessary noise, allowing you to focus on the most critical issues.
The scans are applied across code categories, leading to the enforcement of three run rules:
* **Hard fail**: A repository scan result fails when Prisma Cloud detects a violation or a vulnerability.
* **Soft fail**: A repository scan result passes, but a notification is displayed on the console when Prisma Cloud detects a violation or a vulnerability.
* **Comment bot**: A repository scan result displays issues with suggested fixes as comments within Pull Requests on the VCS (Version Control System).
Prisma Cloud scans the following code categories to detect vulnerabilities and violations unique to each category.
| Code Category | Description |
| -------------------------------- | ------------------------------------------------------------------------------------------ |
| **Vulnerabilities** | SCA vulnerabilities found in open source packages |
| **Infrastructure as Code (IaC)** | Misconfiguration issues found in IaC files |
| **Licenses** | License compliance issues found in open source packages and container images |
| **Secrets** | Secret leaks across code files that might hinder access to information, services or assets |
## Default Enforcement Rules
The following table displays the default enforcement rules associated with each code category, determined by severity level. These rules apply to all repositories by default.
In the table, 'Vulnerability' scans result in a hard fail when detecting critical issues, a soft fail for low severity issues, and trigger a comment bot for medium severity issues.
| Code Category | Severity | | | | |
| ------------------- | ------------- | ------------ | ------ | ---- | --------- |
| | Info | Low | Medium | High | Critical |
| **Vulnerabilities** | Not Supported | | | | Hard Fail |
| Not Supported | Soft Fail | | | | |
| Not Supported | | Comments Bot | | | |
| **Licenses** | Not Supported | Hard Fail | | | |
| Not Supported | Soft Fail | | | | |
| Not Supported | Comments Bot | | | | |
| **IaC** | | Hard Fail | | | |
| | Soft Fail | | | | |
| | Comments Bot | | | | |
| Secrets | | Hard Fail | | | |
| | Soft Fail | | | | |
| | Comments Bot | | | | |
## Manage Enforcement
You can modify the default Enforcement configurations, add an exception, and disable run rules or review pull request scans and suggested vulnerability fixes on your VCS (Version Control System). You can modify the default parameters for any code category. However, each time a default configuration is modified, the modified parameters will be applied across all integrated repositories.
The severity configurations for a code category in **Soft Fail** must be lower than the configurations in **Hard Fail**. For example, if a code category has a critical severity, it cannot be configured for a soft fail if a hard fail is configured for a medium severity.
### Permissions Required to Configure Enforcement
Refer to [Prisma Cloud Administrator Permissions](/content-collections/administration/prisma-cloud-admin-permissions.md) for information about the user roles and permissions allowed to configure Enforcement rules.
## Access Enforcement
1. In **Application Security**, select **Settings** > **Application Security** under 'Configure' in the left side menu > **Enforcement Rules**.
Optionally, you can access Enforcement through **Projects**: In **Application Security** select **Projects** > **Action** menu > **Enforcement**.
## Modify Default Enforcement Configurations
Default enforcement configurations can be modified for any code category. These changes will be applies universally to all integrated repositories.
Default enforcement configurations cannot be deleted.
1. [Access Enforcement](#access-enforcement) settings.
2. In a code category, drag the threshold rule arrow (Hard fail, Soft fail, Comments bot) to your required severity.
In this example for the 'Vulnerabilities' code category, a Hard fail has been downgraded from 'Critical' to' High' vulnerability detection.
3. Optional: Add a label. see [Add Labels](#add-label) below for more information about labels.
4. Select **Save**.
## Add Labels
You can add labels to both default and custom policies. After applying labels, you can create enforcement rules that target specific policy labels and severity thresholds. When PR scans run, only policies matching these criteria will trigger PR comments or cause PR failures. The Projects Enforcement Level filter allows you to focus on relevant findings. Removing these filters will display all findings, regardless of enforcement rule criteria.
NOTES:
* To view labels assigned to Application Security policies: On the Prisma Cloud console, select **Governance**, policy type: **config**, policy subtype **Build**. View the label associated to a policy under the Labels column in a row corresponding to the policy
* To add labels while creating policies, refer to [Custom Build Policies](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/governance/custom-build-policies/custom-build-policies.md)
1. [Access Enforcement](#access-enforcement) settings.
2. Click on the **Label** field > select a label from the drop-down menu > **Save**.
## Add an Exception
To ensure focus on critical issues and receive violation notifications for important repositories, add exceptions to Enforcement rules. You can add an exception for each code category that is applicable. The exception configuration runs in addition to the default enforcement configurations.
Configuring an exception includes defining the scope of the exception, and specifying the repositories code categories and run rules that the exception will apply to.
1. [Access Enforcement](#access-enforcement) settings.
2. Before you begin, ensure that you have the relevant permissions on the repository to add exceptions.
3. Select **Add Exception**.
4. Add a **Description** for the new exception.
5. Select the repositories you want to add the exception for.
You will only view repositories that you own.
6. Modify the severity threshold corresponding to the required code category/ categories.
7. Select **Save**.
EXAMPLE
All exceptions are listed on the **Enforcement** configuration pop-up.
### Editing or Deleting an Exception
* To edit an exception, hover over an exception > select **Edit** to edit configure the parameters > **Save**.
* To delete an exception, select **Edit** > select an exception> **Delete this exception**.
## Disable Enforcement Rules
* Global disable: You can disable enforcement rules globally: Uncheck the **Enable default thresholds for soft-fail, hard-fail and comments bot in your code reviews** setting
* Specific disable: You can [disable ](#turn-off-run-rule-scan-for-a-code-category)the severity threshold for a specific code category
## Disable a run rule for a code category
You can disable one or more run rules (Hard-fail, Soft-fail, Comment-bot) for code categories. This applies to both a default configuration or to an exception.
Disabling a run rule in a code category prevents running a scan for the selected rule.
1. Select a code category.
2. Select **Off** corresponding to the category rule > **Save**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/application-security/risk-management/monitor-and-manage-code-build/enforcement.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.