> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/reference-a-ci-cd-policy-condition-attributes.md).

# Reference A: CI/CD policy Condition attributes

CI/CD policy **Condition** attributes allow you to narrow and focus your policy on specific configurations and risks within your pipelines, workflows and VCS systems.

The following attributes are supported:

* **Severity**. Values: **Select All**, **Critical**, **High**, **Medium**, **Low**
* **Backlog Status**. Values: **Select All**, **Backlog**, **New**

  For more information about **Backlog Status**, refer to [Backlog baseline](/application-security/application-security-posture-management-aspm/backlog-baseline.md).
* **Respect Developer Suppression**. Values: **Select All**, **Yes**, **No**

  For more information on developer suppressions, refer to [Developer suppressions](/application-security/code-security/developer-suppressions.md).
* **Category**. The top-level domain for organizing security findings. Values: **Configuration**, **Vulnerability**, **Malware**, **Identity**, **Data**, **Code**, **Posture**, **Brand Protection**
* **Provider**: The CI/CD platform where the policy will look for misconfigurations. Values: **Select All**, **GitLab CI**, **Azure Pipelines**, **GitHub Actions**, **CircleCI**, **Jenkins**
* **AppSec Rule**: A multi-selection list of available detection rules. Use the search field to find and select the relevant rules.
* **AppSec Rule Label**: A multi-selection list of available rule labels.
* **Subcategory**: Subcategories follow the **OWASP Top 10 CI/CD Security Risks** and similar standards. They define the specific technical security domain or attack vector being addressed, acting as granular filters that allow you to fine-tune the policy to target highly specific risks within your pipelines and VCS assets.

  **Subcategory Values**: Third Party Services, Artifact Integrity Validation, Credential Hygiene, Data Protection, Dependency Chains, Identity & Access Management, Input Validation, Flow Control Mechanisms, Pipeline Based Access Control, Poisoned Pipeline Execution, System Configuration


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/governance-and-enforcement/cicd-policies/reference-a-ci-cd-policy-condition-attributes.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.