# Workflow Run Policies {% hint style="info" %} This feature is currently available for early access. If you installed the [StepSecurity Advanced App](https://github.com/apps/stepsecurity-app) before **May 1st, 2025**, you will need to accept **a new permission** to enable Workflow Run policies: * `actions: write` This permissions is required for StepSecurity Advanced App to cancel GitHub workflow runs. {% endhint %} {% hint style="warning" %} Available for **Enterprise** Tier only {% endhint %} Workflow Run Policies allow you to enforce security controls by blocking GitHub Actions workflow runs that violate organization-defined policies. This is particularly useful for preventing misconfigurations and supply chain attacks in your CI/CD pipelines. ## How It Works When a workflow run violates a policy, the run is automatically blocked. You can define policies such as: * Automatically block compromised GitHub Actions, preventing them from executing in your workflows * Whether secrets can be used on non-default branches * Which GitHub Actions are permitted, including internal/private actions * Which runner labels are allowed or disallowed * Whether workflows are required to run in a hardened environment via the Harden-Runner action Below are the supported policy types and example runs where the policy enforcement blocked workflow execution:

Policy Type	Description	Example Blocked Run	Workflow File
Compromised Actions Policy	Blocks runs of compromised GitHub Actions	Run	Workflow
Secret Exfiltration Policy	Prevents unauthorized access to Secrets	Run	Workflow
Allowed Actions Policy	Blocks runs if a third-party or internal action is not on the allowed list.	Run	Workflow
Runner Label Policy	Blocks runs if the runner label is not in an allowed list.	Run	Workflow
Harden-Runner Policy	Blocks runs that do not have harden-runner action	Run	Workflow

When a workflow run is blocked, you will see this message in the workflow run: ``` The run was canceled by @stepsecurity-app[bot]. ``` Compliant workflow runs continue without any impact—everything runs as expected. Use this interactive demo to learn how to set up an Actions policy in your organization: {% embed url="" %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.stepsecurity.io/github-actions/workflow-run-policies.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.