Skip to main content
Page stub. Full content lives in the README — Policy Bundles. Engineering snapshot at internals/rego-wasm.
hexgate policy build policy.yaml --out ./bundle
# → ./bundle/policy.yaml, .rego, .wasm, .bundle.json
The manifest’s hashes authenticate the files; the signature authenticates the manifest. Verifying both proves the whole bundle came from the trusted signer, untampered.