https://pgabriel-01.github.io/mlops-v3/policy/index.htmlThis section documents the Azure Policy guardrails the accelerator assigns to each environment. Note Policy is a guardrail layer, not the main purpose of the accelerator. It uses built-in policy definitions only, at resource group scope. It does not create custom definitions, initiatives or management-group assignments. Policy mode Set policy_mode in inputs.yaml:Hugoen-ushttps://pgabriel-01.github.io/mlops-v3/policy/assignments/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://pgabriel-01.github.io/mlops-v3/policy/assignments/index.htmlPolicy definitions are built-in, so the accelerator creates no definitions or initiatives. It only assigns them, at resource group scope for each environment. It assigns nothing at management-group or tenant-root scope. Note The table scrolls horizontally on small screens. Default policy assignments With policy_mode: none nothing is assigned. The default is audit, except for scenario 11, where the default is none.https://pgabriel-01.github.io/mlops-v3/policy/faq/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://pgabriel-01.github.io/mlops-v3/policy/faq/index.htmlCommon questions about the policy guardrails. A deployment failed with RequestDisallowedByPolicy. Check the mode. In deny mode, find the failing assignment in the activity log and fix the resource, or switch to audit. Policy shows non-compliant straight after deployment. Compliance evaluation can take up to about 30 minutes. Trigger a scan with az policy state trigger-scan. I already have tenant-wide policy. Use policy_mode: none and let your own assignments apply. Check them against the policy assignments first. Can I add more policies? Yes. Add an entry to the policies map in infra/policy.tf (Terraform) or the policies array in infra/workload.bicep (Bicep). Browse built-ins in AzAdvertizer or the Learn built-in list. Preview policies. The accelerator does not assign preview policies. Live status The e2e.yml workflow applies the assignments in the default audit mode to a real subscription in every scenario except existing-platform, which defaults to none. deny mode has not been tested live.