{
  "slug": "local-pulumi-policy-packs-resolve-esc-environments-d47cf0470e43",
  "title": "Local Pulumi policy packs resolve ESC environments",
  "tools": [
    "pulumi"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-04-16T13:37:11.000Z",
  "announced_at": "2026-04-16T13:37:11.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When configuring a local policy pack with ESC environment secrets or configuration, add an `environments` array of environment references to the JSON config and run `pulumi preview` with both policy-pack flags. ESC configuration is merged into the initial policy configuration; file configuration can override it.",
    "examples": [
      "pulumi preview --policy-pack <path-to-policy-pack> --policy-pack-config <path-to-config.json>",
      "{\n  \"environments\": [\"<org>/<environment>\", \"<org>/<environment>\"],\n  \"<policy-name>\": {\n    \"<setting>\": \"<value>\"\n  }\n}"
    ],
    "gotchas": [
      "Version: v3.231.0",
      "--policy-pack <path-to-policy-pack> (required): Path to the local policy pack directory; the pack must be present on disk.",
      "--policy-pack-config <path-to-config.json> (required): Path to the JSON file containing local policy configuration.",
      "environments: JSON array of ESC environment references to resolve for the local policy pack.",
      "<policy-name>: Object containing configuration for that policy; file configuration can override ESC configuration.",
      "Prerequisite: Pulumi CLI installed; local policy pack available on disk; the runtime chosen by the pack installed.",
      "Prerequisite: Pulumi CLI v3.231.0 or later for the documented release change.",
      "The environment references are resolved client-side via the ESC backend.",
      "File policy configuration can override ESC configuration."
    ]
  },
  "why_it_matters": "Configure a local policy pack to use ESC environment secrets and configuration.",
  "sources": [
    "https://github.com/pulumi/pulumi/releases/tag/v3.231.0",
    "https://github.com/pulumi/pulumi/pull/22495",
    "https://www.pulumi.com/docs/discovery-governance/guides/write-a-policy-pack/",
    "https://www.pulumi.com/docs/discovery-governance/concepts/policy-as-code/"
  ],
  "rank": 0.96024,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-af5adaea926bd1cd-11:gate",
    "evidence_hash": "587340c698707e1fedd57ef2941f2125dd5e05493891dc69d91f50c17f72c30a"
  },
  "review": {
    "draft_hash": "9e7e9060fa143375059a528878fc0cf850763a93e3e8c438e533bc9c39a82986",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.67 (>= 0.6 needed)."
  }
}