With many build systems now generating SBOMs, SLSA provenance, vulnerability reports, etc, we’ve never had more evidence about what goes into our software. But if there's nothing acting on the evidence gathered, our pipelines can still produce non-compliant artifacts.

Collecting evidence is important of course, but looking at the evidence, assessing its correctness, and evaluating compliance with business and security policies for each artifact produced, is what really helps make our build systems more secure, and lets us claim SLSA build levels, and satisfy NIST and EU regulations.

In this session, we highlight the gap between generating build metadata, and actually using it to block non-compliant artifacts. We’ll walk through a realistic pipeline scenario where everything looks compliant on paper — valid SBOM, signed provenance, clean scans — and still it shouldn’t be deployed.

From there, we introduce a different model: treating policies as active, blocking gates that evaluate each artifact against organizational trust requirements and managed policies.

Using Conforma, an open-source Policy-as-Code engine, we will demonstrate how to:
* Transform passive evidence (SPDX SBOMs, SLSA provenance) into enforceable decisions
* Define and apply policies such as trusted builders, CVE thresholds, and license compliance
* Integrate policy evaluation directly into CI/CD pipelines as promotion and deployment gates
* Move toward a Zero-Trust model where every artifact must prove itself before advancing

You’ll leave with a clear understanding of why having the data isn’t the same as being secure, and how to turn your supply chain metadata into an enforced line of defense. We’ll demonstrate this using a policy-as-code approach with Conforma.