Policies
Policies are the directives the Enterprise Manager pushes to Stacklok clients. Each directive controls one aspect of client behavior: which MCP registry clients connect to, whether non-registry servers are allowed, where telemetry flows, and what certificates and environment variables MCP containers get.
Available directives
| Directive | Use it to |
|---|---|
| Registry | Enforce a specific MCP registry URL |
| Non-registry servers | Block or allow MCP servers that are not in the registry |
| Telemetry | Standardize OpenTelemetry collector configuration |
| CA certificate | Inject a custom CA certificate into MCP containers |
| Build environment | Inject environment variables into MCP containers |
Enforcement levels
Every policy directive carries an enforcement field with one of two values:
| Enforcement | Meaning |
|---|---|
enforced | Mandatory. Clients must use the configured value and cannot override it locally. |
default | Advisory. Clients use the configured value as a default but may override it locally. |
Use enforced for mandatory organization-wide settings. Use default to
provide settings that client operators can override locally.
Apply policy changes
After updating enterprise-manager.enterpriseConfig in your Helm values,
upgrade the release to push the change to clients:
helm upgrade stacklok-enterprise \
oci://oci.stacklok.com/stacklok-enterprise/<CHANNEL>/stacklok-enterprise-platform \
--version <VERSION> \
--namespace stacklok-system \
--values values.yaml
Clients receive the updated policy the next time they connect to the Enterprise Manager.
Next steps
Pick a directive to configure:
- Registry policy
- Non-registry servers policy
- Telemetry policy
- CA certificate policy
- Build environment policy
Configure degraded mode to control client behavior when the Enterprise Manager is unreachable.