Governance | StackShip Docs

Control what reaches your infrastructure with policy checks, human approval, and an audit log.

Control	What it does	Read more
Policy sets	Check every plan against your own Rego rules before it can be approved	Policy sets
Approvals	Require a person to approve the exact plan that will be applied	Run approvals
State history	Keep every state version, with one apply writing to a workspace at a time	State
Audit log	Record changes to projects, workspaces, policies, credentials, runs, and state	Audit log

How a change is controlled

A run produces a plan.
Every policy set attached to the workspace checks the plan. A failed mandatory policy stops the run or blocks approval.
An owner or admin approves or discards the plan. Approval covers only that exact plan; if anything changes, the run must be reviewed again.
StackShip applies the plan and saves the new state version.
Each decision, override, and state change is written to the audit log.