> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page.md).

# Cloud workload policies page

The **Cloud Workload Policies** page allows users to manage policies that define security and compliance actions for cloud workloads. Users can create, edit, filter, and manage policies through a structured table and widget panel.

{% hint style="info" %}

#### Note

Keep the following caveats in my mind when working with Policies:

* Instance Administrators are able to view all facets of policies without restrictions, even if Scope Based Access Control (SBAC) roles are in effect. Learn more about [SBAC](file:///document/preview/1410276#UUID-c3eebdf1-af6e-6820-c11d-457e6aabae48).Manage user scope
* If you’ve been assigned a custom role with View/Edit permissions limited by SBAC, you may not be able to view certain policies.
* You can further narrow your search on the Inventory page by using SBAC to limit the scope of the finding, issue, and case counts.
  {% endhint %}

The Cloud Workload Policies page displays all the configured policies with the following fields.

**Policy table columns**

| **Field**            | **Description**                                                                                                                                                 |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Policy Type**      | Defines the policy category: **Misconfigurations, Secrets, Malware, Trusted Images**.                                                                           |
| **Policy Name**      | The user-defined name of the policy.                                                                                                                            |
| **Action**           | Defines the action taken when conditions match: **Create an Issue** (logs an issue) or **Prevent and Create an Issue** (prevents the action and logs an issue). |
| **Severity**         | The severity level of the issue created: **Critical, High, Medium, Low, or Informational**.                                                                     |
| **Asset Groups**     | Predefined groups of assets to which the policy applies.                                                                                                        |
| **Open Issues**      | The number of unresolved issues associated with the policy.                                                                                                     |
| **Conditions**       | Define the detection rule by specifying the criteria that match relevant malware, secret, or trusted image findings.                                            |
| **Exceptions**       | Defines the exclusion criteria to omit malware, secret, or trusted image findings that meet specific conditions you want to exclude from the policy.            |
| **Evaluation Stage** | Indicates at which stage in the **SDLC** the policy is evaluated.                                                                                               |
| **Description**      | Additional details about the policy.                                                                                                                            |
| **Created By**       | The user who created the policy.                                                                                                                                |
| **Last Modified**    | The timestamp of the last modification.                                                                                                                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/cloud-workload-policies-page.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.