Policy guardrails
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
enforce rules with preventive and detective controls.
Planned topics
- Preventive guardrails block non-compliant actions (deny public buckets, deny unapproved regions, require encryption).
- Detective guardrails find drift after the fact and alert or remediate.
- Use preventive for clear rules, detective where blocking would be too disruptive.
- Provide an exception process with an owner and an expiry.
- Treat policies as code: versioned, reviewed, and tested.
Draft outline details
Demonstration
a table: rule, type (preventive or detective), scope, exception path (for example: deny resources outside approved regions, preventive, organization-wide).
Check your understanding
What is the difference between preventive and detective guardrails?
Show answer
Preventive blocks the action; detective finds and reports it afterwards.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.