# ─────────────────────────────────────────────────────────────────────────
# GENERATED at deploy by build-ai-resources.py from the minimal source of
# truth under content/orgs/<org>/ai-resources/. DO NOT EDIT — edit the
# source file instead; this copy is rebuilt on every deploy.
# ─────────────────────────────────────────────────────────────────────────
---
apiVersion: backstage.io/v1alpha1
kind: AiResource
metadata:
  annotations:
    backstage.io/managed-by-location: url:https://static-ai-stack.dc7.io/catalog/example-org/ai-resources/no-secrets-in-catalog-rule.yaml
  name: no-secrets-in-catalog-rule
  title: "No secrets in catalog entities"
  description: "Prevent AI agents from writing credentials, tokens, or connection strings into catalog YAML."
  tags:
    - ai
    - rule
spec:
  type: "rule"
  lifecycle: "production"
  owner: "group:default/platform-team"
  system: "ai-tooling"
  category: "security"
  rationale: "Catalog content is served publicly read-only over HTTPS by roles/static (see the managed-by-location annotation on every entity) and is meant to document intent, not carry secrets. Resource entities model the infrastructure a Component depends on; the actual credentials are provisioned by configuration management and never committed here. An agent adding or editing catalog entities must never inline a password, API key, or connection string — reference the secret's location (an env var name, or the sops-encrypted store) instead."
  disciplines:
    - backend
    - platform
  enforcement: "block"