Enforced rule
An enforced rule is an LGTM organization security rule the org has marked so that no attached repo can override its action. Enforced by <org> shows up as a locked chip on the per-repo policy editor.
What Enforced means
Every rule in an OrganizationPolicy has an optional enforced flag. When it's true, mergeWithOrgPolicy always returns the org's action for that rule, ignoring whatever the repo has set. The per-repo Policy editor renders an 'Enforced by <org>' chip and disables the action selector for that row.
Attempts to override an enforced rule via the API return HTTP 409 with a clear reason. This isn't a suggestion — it's the guarantee the security team relies on.
How to mark a rule Enforced
In the org policy editor, click the lock icon next to any rule. Save. Every repo attached to the org now sees that rule's org-defined action regardless of any local override. Unmark by clicking the lock again.
Only Policy Admins (or Owners) on the org can toggle enforced. Members and Viewers see the chip but cannot flip it.
When to use it
Rules where you cannot accept per-repo drift. Hardcoded-secret detection is the canonical example — no repo owner should be able to downgrade it to warn. OIDC over-permissive trust policies, pull_request_target head-checkout, and privileged Docker builds are common candidates.
Do NOT enforce every rule out of the gate. Enforcement removes autonomy — reserve it for the handful of rules where per-repo variation would be a bug, not a feature.
See enforcement + inheritance in the docs
Chip UI, resolution semantics, examples
Go to the product pageFAQs
Can a repo Owner override an enforced rule?
No. Repo-side authority stops at org-enforced rules. If they need it changed, someone with Policy Admin on the org has to toggle enforcement off.
What action does an enforced rule get?
Whatever the org set — block, warn, or off. Enforced only means 'this action cannot be overridden by attached repos'. It does not itself pick an action.
Related terms
Organization policy
An organization policy is a shared LGTM Security policy that applies to every repository attached to an organization. Repos can layer their own overrides on top, except on rules the org marks as Enforced.
Policy inheritance
Policy inheritance in LGTM Security is how a repo's effective policy is computed: repo policy overlaid on org policy, repo wins on every non-enforced rule, allowlists always union.
CI/CD security
CI/CD security covers the attack surface introduced by your build and deploy pipelines: GitHub Actions workflows, Dockerfiles, IaC configs, dependency management, and secret handling. Distinct from (and complementary to) application-layer AppSec.