> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/manage-cloud-workload-policies.md).

# Manage cloud workload policies

Use Cloud Workload policies to detect risks and enforce actions across your workloads.

Open **Posture Management** → **Rules & Policies** → **Policies** → **Cloud Workload**.

### Create a policy

Select **Create Policy**, then select the policy type.

#### Misconfiguration policy

1. Enter a unique name and description.
2. The evaluation stage is **Runtime**.
3. Select **Next**, then add the rules to evaluate.
4. Set rule severity, policy action, and remediation guidance as needed.
5. Select **Asset Groups** or **Default Asset Scopes** for the policy scope.
6. Select **Done**.

The policy summary updates as you configure its general settings, rules, and scope.

Misconfiguration policies work only at Runtime. The Kubernetes Admission Controller enforces them for clusters onboarded through the Posture Management connector.

Asset groups contain relevant compute assets only. A filter creates a dynamic group. Manually selected assets create a static group.

For Kubernetes Prevent policies, dynamic asset groups support these attributes:

* Kubernetes Resource Cluster, Namespace, Labels, Category, and Creation Time.
* Kubernetes Resource Name.

#### Malware policy

1. Enter a unique name and description.
2. Select **CI**, **Runtime**, or **Deploy**.
3. Define detection criteria and optional exclusions.
4. Configure the scope for the selected stage.
5. Select an action, severity, and optional remediation guidance.
6. Select **Done**.

At **CI**, the policy covers all Cloud Workload Build Container Images. A Prevent action fails the pipeline with exit code `2`.

At **Runtime**, select asset groups or default asset scopes. Default scopes include all Cloud Workload assets, hosts, container images, container instances, Kubernetes workloads, and serverless functions.

At **Deploy**, select registry-image asset groups or all Cloud Workload registry images. Deploy policies create an issue by default.

#### Secret policy

1. Enter a unique name and description.
2. Select **CI**, **Runtime**, or **Deploy**.
3. Define detection criteria and optional exclusions.
4. Configure the stage-specific scope and action.
5. Select **Done**.

The available scopes and actions match those for Malware policies. At CI, the policy applies to all Cloud Workload Build Container Images. At Runtime, choose asset groups or default asset scopes. At Deploy, choose registry-image asset groups or all registry images.

#### Trusted Images policy

1. Enter a unique name and description.
2. The evaluation stage is **Runtime**.
3. Define image trust criteria and any exclusions.
4. Choose **Asset Groups** or **Default Asset Scopes**.
5. Select an action, severity, and optional remediation guidance.
6. Select **Done**.

Use stable image identifiers, such as registries, signatures, or digests. Avoid mutable tags. Pre-ingest images when trust criteria depend on image metadata.

Exclude system-critical namespaces, such as `kube-system`, from the scope. A namespace-scoped asset group applies only to that namespace.

Select **Create an issue** to log a violation. Select **Prevent and create an issue** to block it and log an issue. Trusted Images policies also provide an action for unavailable trust verdicts.

### Enable or disable a policy

1. Select the policy.
2. On the **Details** page, use the toggle at the top.

### Copy a policy

1. Select the policy.
2. On the **Details** page, select **More Options** (**⋮**) → **Save as new**.
3. Update the policy name, conditions, scope, or actions.
4. Select **Done**.

### Edit a policy

1. Select the policy.
2. On the **Details** page, select **Edit**.
3. Make the required changes.
4. Select **Done**.

### Delete a policy

1. Select the policy.
2. On the **Details** page, select **More Options** (**⋮**) → **Delete policy**.
3. Select **Delete** to confirm.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/kubernetes-security/cloud-workload-policies-and-rules/cloud-workload-policies/manage-cloud-workload-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.