apiVersion: atmos/v1
kind: Policy
metadata:
  name: allowed-plugin-registries
  description: Require plugin downloads, cached activation, and registry operations to use an approved OCI registry.
spec:
  policies:
    allowed-plugin-registries:
      on: plugin
      action: deny
      reason: Plugins and catalogs must use an approved company registry
      with:
        allowed_registries:
          - registry.example.com
      rule: >-
        input.origin in ['development', 'layout'] || !(input.registry in params.allowed_registries)