THE INTENT: Production data access requires a decision by the data owner, per request. Emergencies go through break-glass. Nothing else gets in.
policy/prod-data-access.yaml 1 │ id: POL-DATA-03 2 │ implements: "Policy 4.2 — production data access" 3 │ enforcement: deny-by-default 4 │ rules: 5 │ - match: request.resource.classification == "production" 6 │ allow_if: request.user.group in ["sre", "data-platform"] 7 │ log: true 8 │ - match: request.resource.classification == "production" 9 │ allow_if: request.break_glass == true10 │ notify: security-oncall11 │ review_cadence: annual
grc@ctrl-f:~$