Docs
Reference

Rule DSL Reference

The complete grammar of Archigov rules — scopes, matchers, operators, evidence and decision assertions, and how errors are treated.

A rule is a JSON object stored on a catalogue artefact (rule_json). Only adopted artefacts are evaluated in runs; drafts can be dry-run.

#Shape

Text

Rule        = ResourceRule | ApplicationRule

ResourceRule    = { "scope": "resource",    "match"?: Match, "assert": Assert }
ApplicationRule = { "scope": "application", "assert": AppAssert }

Match  = { "type"?: string, "typeIn"?: string[], "typePrefix"?: string, "where"?: Assert[] }

Assert = { "path": string, "op": PathOp, "value"?: any }
       | { "op": "evidence", "control": string, "source"?: Source, "state"?: State }
       | { "op": "decisionConstraint", "topic": string }

AppAssert = { "op": "hasDecision", "topic": string, "type"?: string }
          | { "op": "hasOwnerTag" }
          | { "op": "maxResourcesOfType", "type": string, "max": number }

PathOp = "eq" | "neq" | "in" | "notIn" | "exists" | "missing" | "gte" | "lte" | "matches"
Source = "defender" | "azure_policy" | "manual"
State  = "pass" | "fail" | "unknown"

#Match

Applies to resource rules. All given conditions must hold. A rule with no match applies to every resource.

Key	Meaning
`type`	Resource type equals, e.g. `Microsoft.Storage/storageAccounts`
`typeIn`	Resource type is one of a list
`typePrefix`	Resource type starts with, e.g. `Microsoft.Sql`

Type comparisons are case-insensitive. | where | Every path assertion in the list holds |

#Paths

A path is a dotted path into the resource view:

Path	Value
`name`	Resource name
`type`	Resource type
`location`	Azure region (also `props.location`)
`tags.<key>`	A tag value, e.g. `tags.env`, `tags.owner`
`props.<key>`	A property; the normalised ones are below

Normalised property	Meaning
`props.publicAccess`	Public network access is allowed
`props.minTlsVersion`	Minimum TLS version, e.g. `"1.2"`
`props.httpsOnly`	HTTP is redirected to HTTPS
`props.osSku`	Operating system SKU
`props.location`	Region

#Path Operators

Op	Passes when	`value`
`eq`	Equal (strings compare case-insensitively)	Any
`neq`	Not equal	Any
`in`	Equal to one of	Array
`notIn`	Equal to none of	Array
`exists`	Present, not null and not an empty string	—
`missing`	Absent, null or an empty string	—
`gte`	The value is a number greater than or equal to `value`	Number
`lte`	The value is a number less than or equal to `value`	Number
`matches`	The value is a string matching the regular expression (case-insensitive)	Pattern string

A path that does not resolve is undefined: eq, in, gte, lte and matches fail on it, missing and notIn pass.

#Evidence Assertion

JSON

{ "op": "evidence", "control": "storage-public-access", "source": "defender", "state": "pass" }

Looks up the latest imported evidence for the resource and control (from source, or any source if omitted) and requires its state to equal state (default pass).

No evidence → a finding, no evidence imported for "control", at medium severity. Never a pass.
Different state → a finding at the artefact's severity, carrying the evidence record.

The default control map produces these keys: storage-public-access, storage-secure-transfer, min-tls-1.2, db-public-network-access, web-https-only, kv-purge-protection, kv-soft-delete, cognitive-local-auth, cognitive-public-access and system-updates. Items the map does not know keep defender:<slug> or policy:<definitionName> until mapped in the evidence control map.

#Decision Assertions

decisionConstraint (resource scope) — find the resource's application's accepted decision on topic. If its checkable constraint lists allowedTypes and the resource's type is not among them, the resource is a finding citing the decision. If the application has no accepted decision on the topic, the resource is skipped.

hasDecision (application scope) — the application must have an accepted decision on topic. With type, only applications owning a resource whose type starts with type are checked.

#Other Application Assertions

hasOwnerTag — at least one of the application's resources carries an owner tag.
maxResourcesOfType — the application has at most max resources of type.

#Errors

Rules are validated when an artefact is saved and before every evaluation. An unknown scope or operator, a missing required field (topic, control, type, max), or an invalid regular expression is a rule error: the run lists it under rule_errors, the artefact shows it, and it never counts as passing.

#Findings

Each failure becomes a finding keyed by artefact × element × application, with first-seen and last-seen dates, the artefact's severity, a message, and evidence: the path with expected and actual values, the imported evidence record, or the decision and its allowed types.

Something unclear or out of date? Write to hello@archigov.com or open an issue on GitHub.