From 4030ff4d4f62af6c52ccd0588add5ce0658ec07e Mon Sep 17 00:00:00 2001
From: fullsend-code
 <278716306+fullsend-ai-coder[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 15:24:52 +0000
Subject: [PATCH] docs(#1811): add enforcement-delegation parity check to
 review checklist

Add a fourth item to the Review Checklist for New Policy Rules in
AGENTS.md covering enforcement-delegation collection parity. When a
deny rule conditionally bypasses to another package, reviewers must
now verify that the destination package's rules cover all collections
declared by the bypassed rule. This addresses the gap identified in
PR #1805 where four test_attestation rules lacked redhat_security
collection membership, creating an enforcement gap.

Closes #1811
---
 AGENTS.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 394d0b896..9df0c9f5b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -99,6 +99,12 @@ Rego is a declarative policy language (Datalog-inspired), not imperative code:
   the pattern.
 - **Test coverage:** Every new rule needs tests in a corresponding `_test.rego` file. CI enforces
   100% coverage.
+- **Enforcement delegation parity.** When a deny rule conditionally skips its
+  denial (bypass path), verify that the package receiving enforcement provides
+  equivalent coverage. Specifically: compare the `collections:` list of the
+  bypassed rule against every rule in the destination package. If the bypassed
+  rule belongs to a collection that the destination rules do not, the delegation
+  creates an enforcement gap for consumers of that collection.
 
 ## PR Conventions