> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies.md).

# Cloud workload policies

Configure Cortex XSIAM cloud workload policies to detect violations, create issues, and prevent risks across SDLC stages.

Cloud Workload Policies help you prevent and manage security violations in your cloud runtime instances. They enable you to apply detection logic to specific asset groups at the desired SDLC stage, and define what action needs to be taken if the conditions are met.

Depending on the nature of the security violation, a Cloud Workload Policy allows you to

* *Prevent the violation*. Enable proactive prevention of the violation. For example: Block an S3 bucket deployment that is open to the public.
* *Create an issue*. Create an issue when violation is seen. For example: Create an issue when an AWS credential file is found on a Linux server.

{% hint style="info" %}

### Note

Issues are automatically resolved when the finding is no longer applicable to the asset or when the affected asset is removed from the inventory.

For more details on Prevent and create issues, see [Cloud Workload Preventive Action](/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-preventive-action.md).
{% endhint %}

A Cortex Cloud Workload Policy has the following elements:

* **SDLC Evaluation Stage:** The SDLC stage at which the policy is applied and evaluated. Depending on the policy type, one or more of the following stages may be available:
  * **CI:** The stage during which a pipeline builds the artifact. After building the artifact, the pipeline pushes it to a registry.
  * **Deploy:** The stage when the artifact is pushed to a cloud instance for running.
  * **Runtime:** The stage when the artifact is running on a cloud instance.
* **Rule (Conditions):** The logical conditions that will trigger the evaluation of this policy.
* **Scope:** A filter specifying which assets the rule applies to.
* **Action:** The response triggered when the rule evaluates successfully (only when part of a policy). Based on the rules included in the policy, it can create an issue or prevent the security violation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/rules-and-policies/cloud-workload-policies-and-rules/cloud-workload-policies.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.