> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies.md).

# Cloud workload policies

Cloud Workload Policies help you prevent and manage security violations in your cloud runtime instances. They enable you to apply detection logic to specific asset groups at the desired SDLC stage, and define what action needs to be taken if the conditions are met.

### Depending on the nature of the security violation, a Cloud Workload Policy allows you to

* **Prevent the violation.** Enable proactive prevention of the violation. For example: Block an S3 bucket deployment that is open to the public.
* **Create an issue.** Create an issue when violation is seen. For example: Create an issue when an AWS credential file is found on a Linux server.

{% hint style="info" %}

#### Note

Issues are automatically resolved when the finding is no longer applicable to the asset or when the affected asset is removed from the inventory.
{% endhint %}

For more details on Prevent and create issues, see [Cloud Workload Preventive Action](/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-preventive-action.md).

### A Cortex Cloud Workload Policy has the following elements:

* **SDLC Evaluation Stage:** The SDLC stage at which the policy is applied and evaluated. Depending on the policy type, one or more of the following stages may be available:
  * **CI:** The stage during which a pipeline builds the artifact. After building the artifact, the pipeline pushes it to a registry.
  * **Deploy:** The stage when the artifact is pushed to a cloud instance for running.
  * **Runtime:** The stage when the artifact is running on a cloud instance.
* **Rule (Conditions):** The logical conditions that will trigger the evaluation of this policy.
* **Scope:** A filter specifying which assets the rule applies to.
* **Action:** The response triggered when the rule evaluates successfully (only when part of a policy). Based on the rules included in the policy, it can create an issue or prevent the security violation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.