gistfile1.txt

package choria

default allow = false

# run puppet only in development, with a fact filter and in USEAST1
allow {
  input.action = "runonce"
  input.agent = "puppet"
  input.collective = "development"
  count(input.filter.fact) > 0
  input.site = "USEAST1"
}

# but can do status anywhere
allow {
  input.agent = "puppet"
  input.action = "status"
}