Repository: diggerhq/digger
Pull request #461 (2023-07-19 14:46:06)

support plan policy


Patch:
diff --git a/go.sum b/go.sum
index a504d38f..14607448 100644
--- a/go.sum
+++ b/go.sum
@@ -1,14 +1,10 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys=
 cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
-cloud.google.com/go/compute v1.18.0 h1:FEigFqoDbys2cvFkZ9Fjq4gnHBP55anJ0yQyau2f9oY=
-cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
 cloud.google.com/go/compute v1.19.1 h1:am86mquDUgjGNWxiGn+5PGLbmgiWXlE/yNWpIpNvuXY=
 cloud.google.com/go/compute v1.19.1/go.mod h1:6ylj3a05WF8leseCdIf77NK0g1ey+nj5IKd5/kvShxE=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/iam v0.12.0 h1:DRtTY29b75ciH6Ov1PHb4/iat2CLCvrOm40Q0a6DFpE=
-cloud.google.com/go/iam v0.12.0/go.mod h1:knyHGviacl11zrtZUoDuYpDgLjvr28sLQaG0YB2GYAY=
 cloud.google.com/go/iam v0.13.0 h1:+CmB+K0J/33d0zSQ9SlFWUeCCEn5XJA0ZMZ3pHE9u8k=
 cloud.google.com/go/iam v0.13.0/go.mod h1:ljOg+rcNfzZ5d6f1nAUJ8ZIxOaZUVoS14bKCtaLZ/D0=
 cloud.google.com/go/longrunning v0.4.1 h1:v+yFJOfKC3yZdY6ZUI933pIYdhyhV8S3NpWrXWmg7jM=
@@ -33,12 +29,6 @@ github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRB
 github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
-github.com/aws/aws-sdk-go v1.44.291 h1:JVgIyvdYm/A6iCHD0UIS/Hvu/GVHjpW7bN3mwG6sHlU=
-github.com/aws/aws-sdk-go v1.44.291/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go v1.44.295 h1:SGjU1+MqttXfRiWHD6WU0DRhaanJgAFY+xIhEaugV8Y=
-github.com/aws/aws-sdk-go v1.44.295/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
-github.com/aws/aws-sdk-go v1.44.296 h1:ALRZIIKI+6EBWDiWP4RHWmOtHZ7dywRzenL4NWgNI2A=
-github.com/aws/aws-sdk-go v1.44.296/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go v1.44.300 h1:Zn+3lqgYahIf9yfrwZ+g+hq/c3KzUBaQ8wqY/ZXiAbY=
 github.com/aws/aws-sdk-go v1.44.300/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -52,7 +42,6 @@ github.com/caarlos0/env/v8 v8.0.0/go.mod h1:7K4wMY9bH0esiXSSHlfHLX5xKGQMnkH5Fk4T
 github.com/cenkalti/backoff/v4 v4.2.0 h1:HN5dHm3WBOgndBH6E8V0q2jIYIR3s9yglV8k/+MN3u4=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
@@ -68,8 +57,6 @@ github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWa
 github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
 github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
-github.com/dominikbraun/graph v0.22.3 h1:2bbNzuMX+iKpM+XW1YPu7ch8IyXi/VbG7UYrRj2FHuI=
-github.com/dominikbraun/graph v0.22.3/go.mod h1:yOjYyogZLY1LSG9E33JWZJiq5k83Qy2C6POAuiViluc=
 github.com/dominikbraun/graph v0.23.0 h1:TdZB4pPqCLFxYhdyMFb1TBdFxp8XLcJfTTBQucVPgCo=
 github.com/dominikbraun/graph v0.23.0/go.mod h1:yOjYyogZLY1LSG9E33JWZJiq5k83Qy2C6POAuiViluc=
 github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
@@ -84,7 +71,6 @@ github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
 github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -93,7 +79,6 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre
 github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
 github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -154,9 +139,6 @@ github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9Y
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/klauspost/compress v1.13.6 h1:P76CopJELS0TiO2mebmnzgWaajssP/EszplttgQxcgc=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -167,11 +149,6 @@ github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfr
 github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5 h1:YH424zrwLTlyHSH/GzLMJeu5zhYVZSx5RQxGKm1h96s=
 github.com/microsoft/azure-devops-go-api/azuredevops v1.0.0-b5/go.mod h1:PoGiBqKSQK1vIfQ+yVaFcGjDySHvym6FM1cNYnwzbrY=
 github.com/miekg/dns v1.1.43 h1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/open-policy-agent/opa v0.53.1 h1:APN8iA7Txgel13kSkc6S8dbUulydiPojXt6iyubmB7Q=
-github.com/open-policy-agent/opa v0.53.1/go.mod h1:j3wl8FqSz/+u33Scl72Ms2wxkZx4yZPdqSCrOqBqdsA=
 github.com/open-policy-agent/opa v0.54.0 h1:mGEsK+R5ZTMV8fzzbNzmYDGbTmY30wmRCIHmtm2VqWs=
 github.com/open-policy-agent/opa v0.54.0/go.mod h1:d8I8jWygKGi4+T4H07qrbeCdH1ITLsEfT0M+bsvxWw0=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
@@ -180,8 +157,6 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
-github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
 github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
 github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -189,15 +164,11 @@ github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvq
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
 github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
 github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
-github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
-github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
 github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
 github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 h1:MkV+77GLUNo5oJ0jf870itWm3D0Sjh7+Za9gazKc5LQ=
 github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
-github.com/sirupsen/logrus v1.9.2 h1:oxx1eChJGI6Uks2ZC4W1zpLlVgqB8ner4EuQwV4Ik1Y=
-github.com/sirupsen/logrus v1.9.2/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -218,8 +189,6 @@ github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMc
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/yashtewari/glob-intersection v0.1.0 h1:6gJvMYQlTDOL3dMsPF6J0+26vwX9MB8/1q3uAdhmTrg=
-github.com/yashtewari/glob-intersection v0.1.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
 github.com/yashtewari/glob-intersection v0.2.0 h1:8iuHdN88yYuCzCdjt0gDe+6bAhUwBeEWqThExu54RFg=
 github.com/yashtewari/glob-intersection v0.2.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
@@ -240,8 +209,6 @@ go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJP
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
 golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -260,8 +227,6 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
 golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -284,8 +249,6 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
 golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -296,8 +259,6 @@ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58=
 golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
@@ -322,8 +283,6 @@ google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCID
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20230320184635-7606e756e683 h1:khxVcsk/FhnzxMKOyD+TDGwjbEOpcPuIpmafPGFmhMA=
-google.golang.org/genproto v0.0.0-20230320184635-7606e756e683/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -331,8 +290,6 @@ google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyac
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
 google.golang.org/grpc v1.56.1 h1:z0dNfjIl0VpaZ9iSVjA6daGatAYwPGstTjt5vkRMFkQ=
 google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
diff --git a/pkg/core/execution/execution.go b/pkg/core/execution/execution.go
index f1dc16e8..cb3f27d4 100644
--- a/pkg/core/execution/execution.go
+++ b/pkg/core/execution/execution.go
@@ -17,7 +17,7 @@ import (
 )
 
 type Executor interface {
-	Plan() (bool, string, error)
+	Plan() (bool, string, string, error)
 	Apply() (bool, error)
 }
 
@@ -26,17 +26,17 @@ type LockingExecutorWrapper struct {
 	Executor    Executor
 }
 
-func (l LockingExecutorWrapper) Plan() (bool, string, error) {
+func (l LockingExecutorWrapper) Plan() (bool, string, string, error) {
 	plan := ""
 	locked, err := l.ProjectLock.Lock()
 	if err != nil {
-		return false, "", fmt.Errorf("error locking project: %v", err)
+		return false, "", "", fmt.Errorf("error locking project: %v", err)
 	}
 	log.Printf("Lock result: %t\n", locked)
 	if locked {
 		return l.Executor.Plan()
 	} else {
-		return false, plan, nil
+		return false, plan, "", nil
 	}
 }
 
@@ -108,8 +108,9 @@ func (d ProjectPathProvider) StoredPlanFilePath() string {
 	return path.Join(d.ProjectNamespace, d.PlanFileName())
 }
 
-func (d DiggerExecutor) Plan() (bool, string, error) {
+func (d DiggerExecutor) Plan() (bool, string, string, error) {
 	plan := ""
+	terraformPlanOutput := ""
 	var planSteps []models.Step
 
 	if d.PlanStage != nil {
@@ -128,7 +129,7 @@ func (d DiggerExecutor) Plan() (bool, string, error) {
 		if step.Action == "init" {
 			_, _, err := d.TerraformExecutor.Init(step.ExtraArgs, d.StateEnvVars)
 			if err != nil {
-				return false, "", fmt.Errorf("error running init: %v", err)
+				return false, "", "", fmt.Errorf("error running init: %v", err)
 			}
 		}
 		if step.Action == "plan" {
@@ -136,30 +137,35 @@ func (d DiggerExecutor) Plan() (bool, string, error) {
 			planArgs = append(planArgs, step.ExtraArgs...)
 			isNonEmptyPlan, stdout, stderr, err := d.TerraformExecutor.Plan(planArgs, d.CommandEnvVars)
 			if err != nil {
-				return false, "", fmt.Errorf("error executing plan: %v", err)
+				return false, "", "", fmt.Errorf("error executing plan: %v", err)
 			}
 			if d.PlanStorage != nil {
 				planExists, err := d.PlanStorage.PlanExists(d.PlanPathProvider.StoredPlanFilePath())
 				if err != nil {
-					return false, "", fmt.Errorf("error checking if plan exists: %v", err)
+					return false, "", "", fmt.Errorf("error checking if plan exists: %v", err)
 				}
 
 				if planExists {
 					err = d.PlanStorage.DeleteStoredPlan(d.PlanPathProvider.StoredPlanFilePath())
 					if err != nil {
-						return false, "", fmt.Errorf("error deleting plan: %v", err)
+						return false, "", "", fmt.Errorf("error deleting plan: %v", err)
 					}
 				}
 
 				err = d.PlanStorage.StorePlan(d.PlanPathProvider.LocalPlanFilePath(), d.PlanPathProvider.StoredPlanFilePath())
 				if err != nil {
-					return false, "", fmt.Errorf("error storing plan: %v", err)
+					return false, "", "", fmt.Errorf("error storing plan: %v", err)
 				}
 			}
 			plan = cleanupTerraformPlan(isNonEmptyPlan, err, stdout, stderr)
 			if err != nil {
 				fmt.Printf("error publishing comment: %v", err)
 			}
+
+			showArgs := []string{"-no-color", "-json", d.PlanPathProvider.LocalPlanFilePath()}
+			terraformPlanOutput, _, _ = d.TerraformExecutor.Show(showArgs, d.CommandEnvVars)
+			// perform a rego check of plan policy and terraform json output
+
 		}
 		if step.Action == "run" {
 			var commands []string
@@ -170,11 +176,11 @@ func (d DiggerExecutor) Plan() (bool, string, error) {
 			log.Printf("Running %v for **%v**\n", step.Value, d.ProjectNamespace+"#"+d.ProjectName)
 			_, _, err := d.CommandRunner.Run(d.ProjectPath, step.Shell, commands)
 			if err != nil {
-				return false, "", fmt.Errorf("error running command: %v", err)
+				return false, "", "", fmt.Errorf("error running command: %v", err)
 			}
 		}
 	}
-	return true, plan, nil
+	return true, plan, terraformPlanOutput, nil
 }
 
 func (d DiggerExecutor) Apply() (bool, error) {
diff --git a/pkg/core/policy/policy.go b/pkg/core/policy/policy.go
index 3aa6b26f..cd47571a 100644
--- a/pkg/core/policy/policy.go
+++ b/pkg/core/policy/policy.go
@@ -3,9 +3,12 @@ package policy
 import "digger/pkg/ci"
 
 type Provider interface {
-	GetPolicy(namespace string, projectname string) (string, error)
+	GetAccessPolicy(organisation string, repository string, projectname string) (string, error)
+	GetPlanPolicy(organisation string, repository string, projectname string) (string, error)
+	GetOrganisation() string
 }
 
 type Checker interface {
-	Check(ciService ci.OrgService, SCMOrganisation string, SCMrepository string, projectname string, command string, requestedBy string) (bool, error)
+	CheckAccessPolicy(ciService ci.OrgService, SCMOrganisation string, SCMrepository string, projectname string, command string, requestedBy string) (bool, error)
+	CheckPlanPolicy(SCMrepository string, projectname string, planOutput string) (bool, error)
 }
diff --git a/pkg/core/terraform/tf.go b/pkg/core/terraform/tf.go
index 2ed56331..dda56846 100644
--- a/pkg/core/terraform/tf.go
+++ b/pkg/core/terraform/tf.go
@@ -13,6 +13,7 @@ type TerraformExecutor interface {
 	Init([]string, map[string]string) (string, string, error)
 	Apply([]string, *string, map[string]string) (string, string, error)
 	Plan([]string, map[string]string) (bool, string, string, error)
+	Show([]string, map[string]string) (string, string, error)
 }
 
 type Terragrunt struct {
@@ -44,6 +45,11 @@ func (terragrunt Terragrunt) Plan(params []string, envs map[string]string) (bool
 	return true, stdout, stderr, err
 }
 
+func (terragrunt Terragrunt) Show(params []string, envs map[string]string) (string, string, error) {
+	stdout, stderr, err := terragrunt.runTerragruntCommand("show", envs, params...)
+	return stdout, stderr, err
+}
+
 func (terragrunt Terragrunt) runTerragruntCommand(command string, envs map[string]string, arg ...string) (string, string, error) {
 	args := []string{command}
 	args = append(args, arg...)
@@ -198,3 +204,11 @@ func (tf Terraform) Plan(params []string, envs map[string]string) (bool, string,
 	}
 	return statusCode != 2, stdout, stderr, nil
 }
+
+func (tf Terraform) Show(params []string, envs map[string]string) (string, string, error) {
+	stdout, stderr, _, err := tf.runTerraformCommand("show", envs, params...)
+	if err != nil {
+		return "", "", err
+	}
+	return stdout, stderr, nil
+}
diff --git a/pkg/digger/digger.go b/pkg/digger/digger.go
index a3b035e6..8e562b25 100644
--- a/pkg/digger/digger.go
+++ b/pkg/digger/digger.go
@@ -88,7 +88,7 @@ func RunCommandsPerProject(
 		for _, command := range projectCommands.Commands {
 			fmt.Printf("Running '%s' for project '%s'\n", command, projectCommands.ProjectName)
 
-			allowedToPerformCommand, err := policyChecker.Check(orgService, SCMOrganisation, SCMrepository, projectCommands.ProjectName, command, requestedBy)
+			allowedToPerformCommand, err := policyChecker.CheckAccessPolicy(orgService, SCMOrganisation, SCMrepository, projectCommands.ProjectName, command, requestedBy)
 
 			if err != nil {
 				return false, false, fmt.Errorf("error checking policy: %v", err)
@@ -155,7 +155,8 @@ func RunCommandsPerProject(
 				if err != nil {
 					return false, false, fmt.Errorf("failed to set PR status. %v", err)
 				}
-				planPerformed, plan, err := diggerExecutor.Plan()
+				planPerformed, plan, planJsonOutput, err := diggerExecutor.Plan()
+
 				if err != nil {
 					log.Printf("Failed to run digger plan command. %v", err)
 					err := prService.SetStatus(prNumber, "failure", projectCommands.ProjectName+"/plan")
@@ -170,6 +171,20 @@ func RunCommandsPerProject(
 						if err != nil {
 							log.Printf("Failed to report plan. %v", err)
 						}
+						planIsAllowed, err := policyChecker.CheckPlanPolicy(SCMrepository, projectCommands.ProjectName, planJsonOutput)
+						if err != nil {
+							log.Printf("failed to validate plan %v", err)
+							return false, false, fmt.Errorf("failed to validated plan %v", err)
+						}
+						if !planIsAllowed {
+							formatter := utils.AsCollapsibleComment("Terraform plan failed validation checks")
+							err = reporter.Report("Terraform plan failed validation checks", formatter)
+							if err != nil {
+								log.Printf("Failed to report plan. %v", err)
+							}
+							log.Printf("Plan is not allowed")
+							return false, false, fmt.Errorf("Plan is not allowed")
+						}
 					}
 					err := prService.SetStatus(prNumber, "success", projectCommands.ProjectName+"/plan")
 					if err != nil {
@@ -281,7 +296,7 @@ func RunCommandForProject(
 
 	for _, command := range commands.Commands {
 
-		allowedToPerformCommand, err := policyChecker.Check(orgService, SCMOrganisation, SCMrepository, commands.ProjectName, command, requestedBy)
+		allowedToPerformCommand, err := policyChecker.CheckAccessPolicy(orgService, SCMOrganisation, SCMrepository, commands.ProjectName, command, requestedBy)
 
 		if err != nil {
 			return fmt.Errorf("error checking policy: %v", err)
@@ -332,11 +347,21 @@ func RunCommandForProject(
 			if err != nil {
 				log.Printf("Failed to send usage report. %v", err)
 			}
-			_, _, err = diggerExecutor.Plan()
+			_, _, planJsonOutput, err := diggerExecutor.Plan()
 			if err != nil {
 				log.Printf("Failed to run digger plan command. %v", err)
 				return fmt.Errorf("failed to run digger plan command. %v", err)
 			}
+			planIsAllowed, err := policyChecker.CheckPlanPolicy(SCMrepository, commands.ProjectName, planJsonOutput)
+			if err != nil {
+				log.Printf("failed to validate plan %v", err)
+				return fmt.Errorf("failed to validated plan %v", err)
+			}
+			if !planIsAllowed {
+				log.Printf("Plan is not allowed")
+				return fmt.Errorf("Plan is not allowed")
+			}
+
 		case "digger apply":
 			err := usage.SendUsageRecord(requestedBy, eventName, "apply")
 			if err != nil {
@@ -373,7 +398,7 @@ func SortedCommandsByDependency(project []models.ProjectCommand, dependencyGraph
 func MergePullRequest(ciService ci.PullRequestService, prNumber int) {
 	time.Sleep(5 * time.Second)
 
-	// Check if it was manually merged
+	// CheckAccessPolicy if it was manually merged
 	isMerged, err := ciService.IsMerged(prNumber)
 	if err != nil {
 		log.Fatalf("error checking if PR is merged: %v", err)
diff --git a/pkg/policy/policy.go b/pkg/policy/policy.go
index 5d3327b4..16d98dfe 100644
--- a/pkg/policy/policy.go
+++ b/pkg/policy/policy.go
@@ -3,6 +3,8 @@ package policy
 import (
 	"context"
 	"digger/pkg/ci"
+	"digger/pkg/core/policy"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"github.com/open-policy-agent/opa/rego"
@@ -12,11 +14,6 @@ import (
 	"net/url"
 )
 
-type PolicyProvider interface {
-	GetPolicy(organisation string, repository string, projectname string) (string, error)
-	GetOrganisation() string
-}
-
 type DiggerHttpPolicyProvider struct {
 	DiggerHost         string
 	DiggerOrganisation string
@@ -27,11 +24,15 @@ type DiggerHttpPolicyProvider struct {
 type NoOpPolicyChecker struct {
 }
 
-func (p NoOpPolicyChecker) Check(_ ci.OrgService, _ string, _ string, _ string, _ string, _ string) (bool, error) {
+func (p NoOpPolicyChecker) CheckAccessPolicy(_ ci.OrgService, _ string, _ string, _ string, _ string, _ string) (bool, error) {
+	return true, nil
+}
+
+func (p NoOpPolicyChecker) CheckPlanPolicy(_ string, _ string, _ string) (bool, error) {
 	return true, nil
 }
 
-func getPolicyForOrganisation(p *DiggerHttpPolicyProvider) (string, *http.Response, error) {
+func getAccessPolicyForOrganisation(p *DiggerHttpPolicyProvider) (string, *http.Response, error) {
 	organisation := p.DiggerOrganisation
 	u, err := url.Parse(p.DiggerHost)
 	if err != nil {
@@ -57,7 +58,33 @@ func getPolicyForOrganisation(p *DiggerHttpPolicyProvider) (string, *http.Respon
 	return string(body), resp, nil
 }
 
-func getPolicyForNamespace(p *DiggerHttpPolicyProvider, namespace string, projectName string) (string, *http.Response, error) {
+func getPlanPolicyForOrganisation(p *DiggerHttpPolicyProvider) (string, *http.Response, error) {
+	organisation := p.DiggerOrganisation
+	u, err := url.Parse(p.DiggerHost)
+	if err != nil {
+		log.Fatalf("Not able to parse digger cloud url: %v", err)
+	}
+	u.Path = "/orgs/" + organisation + "/plan-policy"
+	req, err := http.NewRequest("GET", u.String(), nil)
+	if err != nil {
+		return "", nil, err
+	}
+	req.Header.Add("Authorization", "Bearer "+p.AuthToken)
+
+	resp, err := p.HttpClient.Do(req)
+	if err != nil {
+		return "", nil, err
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", resp, nil
+	}
+	return string(body), resp, nil
+}
+
+func getAccessPolicyForNamespace(p *DiggerHttpPolicyProvider, namespace string, projectName string) (string, *http.Response, error) {
 	// fetch RBAC policies for project from Digger API
 	u, err := url.Parse(p.DiggerHost)
 	if err != nil {
@@ -85,10 +112,37 @@ func getPolicyForNamespace(p *DiggerHttpPolicyProvider, namespace string, projec
 
 }
 
+func getPlanPolicyForNamespace(p *DiggerHttpPolicyProvider, namespace string, projectName string) (string, *http.Response, error) {
+	u, err := url.Parse(p.DiggerHost)
+	if err != nil {
+		log.Fatalf("Not able to parse digger cloud url: %v", err)
+	}
+	u.Path = "/repos/" + namespace + "/projects/" + projectName + "/plan-policy"
+	req, err := http.NewRequest("GET", u.String(), nil)
+
+	if err != nil {
+		return "", nil, err
+	}
+	req.Header.Add("Authorization", "Bearer "+p.AuthToken)
+
+	resp, err := p.HttpClient.Do(req)
+	if err != nil {
+		return "", nil, err
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", resp, nil
+	}
+	return string(body), resp, nil
+
+}
+
 // GetPolicy fetches policy for particular project,  if not found then it will fallback to org level policy
-func (p *DiggerHttpPolicyProvider) GetPolicy(organisation string, repo string, projectName string) (string, error) {
+func (p *DiggerHttpPolicyProvider) GetAccessPolicy(organisation string, repo string, projectName string) (string, error) {
 	namespace := fmt.Sprintf("%v-%v", organisation, repo)
-	content, resp, err := getPolicyForNamespace(p, namespace, projectName)
+	content, resp, err := getAccessPolicyForNamespace(p, namespace, projectName)
 	if err != nil {
 		return "", err
 	}
@@ -100,7 +154,37 @@ func (p *DiggerHttpPolicyProvider) GetPolicy(organisation string, repo string, p
 
 	// check if project policy was empty or not found (retrieve org policy if so)
 	if (resp.StatusCode == 200 && content == "") || resp.StatusCode == 404 {
-		content, resp, err := getPolicyForOrganisation(p)
+		content, resp, err := getAccessPolicyForOrganisation(p)
+		if err != nil {
+			return "", err
+		}
+		if resp.StatusCode == 200 {
+			return content, nil
+		} else if resp.StatusCode == 404 {
+			return "", nil
+		} else {
+			return "", errors.New(fmt.Sprintf("unexpected response while fetching organisation policy: %v, code %v", content, resp.StatusCode))
+		}
+	} else {
+		return "", errors.New(fmt.Sprintf("unexpected response while fetching project policy: %v code %v", content, resp.StatusCode))
+	}
+}
+
+func (p *DiggerHttpPolicyProvider) GetPlanPolicy(organisation string, repo string, projectName string) (string, error) {
+	namespace := fmt.Sprintf("%v-%v", organisation, repo)
+	content, resp, err := getPlanPolicyForNamespace(p, namespace, projectName)
+	if err != nil {
+		return "", err
+	}
+
+	// project policy found
+	if resp.StatusCode == 200 && content != "" {
+		return content, nil
+	}
+
+	// check if project policy was empty or not found (retrieve org policy if so)
+	if (resp.StatusCode == 200 && content == "") || resp.StatusCode == 404 {
+		content, resp, err := getPlanPolicyForOrganisation(p)
 		if err != nil {
 			return "", err
 		}
@@ -121,12 +205,13 @@ func (p *DiggerHttpPolicyProvider) GetOrganisation() string {
 }
 
 type DiggerPolicyChecker struct {
-	PolicyProvider PolicyProvider
+	PolicyProvider policy.Provider
 }
 
-func (p DiggerPolicyChecker) Check(ciService ci.OrgService, SCMOrganisation string, SCMrepository string, projectName string, command string, requestedBy string) (bool, error) {
+func (p DiggerPolicyChecker) CheckAccessPolicy(ciService ci.OrgService, SCMOrganisation string, SCMrepository string, projectName string, command string, requestedBy string) (bool, error) {
+	// TODO: Get rid of organisation if its not needed
 	organisation := p.PolicyProvider.GetOrganisation()
-	policy, err := p.PolicyProvider.GetPolicy(organisation, SCMrepository, projectName)
+	policy, err := p.PolicyProvider.GetAccessPolicy(organisation, SCMrepository, projectName)
 
 	if err != nil {
 		fmt.Printf("Error while fetching policy: %v", err)
@@ -141,7 +226,7 @@ func (p DiggerPolicyChecker) Check(ciService ci.OrgService, SCMOrganisation stri
 
 	input := map[string]interface{}{
 		"user":         requestedBy,
-		"organisation": organisation,
+		"organisation": SCMOrganisation,
 		"teams":        teams,
 		"action":       command,
 		"project":      projectName,
@@ -181,3 +266,58 @@ func (p DiggerPolicyChecker) Check(ciService ci.OrgService, SCMOrganisation stri
 
 	return true, nil
 }
+
+func (p DiggerPolicyChecker) CheckPlanPolicy(SCMrepository string, projectName string, planOutput string) (bool, error) {
+	// TODO: Get rid of organisation if its not needed
+	organisation := p.PolicyProvider.GetOrganisation()
+	policy, err := p.PolicyProvider.GetPlanPolicy(organisation, SCMrepository, projectName)
+	if err != nil {
+		return false, fmt.Errorf("failed get plan policy: %v", err)
+	}
+	var parsedPlanOutput map[string]interface{}
+	err = json.Unmarshal([]byte(planOutput), &parsedPlanOutput)
+	if err != nil {
+		return false, fmt.Errorf("failed to parse json terraform output to map: %v", err)
+	}
+
+	input := map[string]interface{}{
+		"terraform": parsedPlanOutput,
+	}
+
+	if policy == "" {
+		return true, nil
+	}
+
+	ctx := context.Background()
+	fmt.Printf("DEBUG: passing the following input policy: %v ||| text: %v", input, policy)
+	query, err := rego.New(
+		rego.Query("data.digger.deny"),
+		rego.Module("digger", policy),
+	).PrepareForEval(ctx)
+
+	if err != nil {
+		return false, err
+	}
+
+	results, err := query.Eval(ctx, rego.EvalInput(input))
+	if len(results) == 0 || len(results[0].Expressions) == 0 {
+		return false, fmt.Errorf("no result found")
+	}
+
+	expressions := results[0].Expressions
+
+	for _, expression := range expressions {
+		decisions, ok := expression.Value.([]interface{})
+		if !ok {
+			return false, fmt.Errorf("decision is not a slice of interfaces")
+		}
+		if len(decisions) > 0 {
+			for _, d := range decisions {
+				fmt.Printf("denied: %v\n", d)
+			}
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
diff --git a/pkg/utils/mocks.go b/pkg/utils/mocks.go
index 0aa1a603..72606113 100644
--- a/pkg/utils/mocks.go
+++ b/pkg/utils/mocks.go
@@ -44,7 +44,11 @@ func (lock *MockLock) GetLock(resource string) (*int, error) {
 type MockPolicyChecker struct {
 }
 
-func (t MockPolicyChecker) Check(ciService ci.OrgService, SCMOrganisation string, SCMrepository string, projectName string, command string, requestedBy string) (bool, error) {
+func (t MockPolicyChecker) CheckAccessPolicy(ciService ci.OrgService, SCMOrganisation string, SCMrepository string, projectName string, command string, requestedBy string) (bool, error) {
+	return false, nil
+}
+
+func (t MockPolicyChecker) CheckPlanPolicy(projectName string, command string, requestedBy string) (bool, error) {
 	return false, nil
 }
 


Test patch:
diff --git a/pkg/digger/digger_test.go b/pkg/digger/digger_test.go
index 1fe30dec..54dea31b 100644
--- a/pkg/digger/digger_test.go
+++ b/pkg/digger/digger_test.go
@@ -48,6 +48,11 @@ func (m *MockTerraformExecutor) Apply(params []string, plan *string, envs map[st
 	return "", "", nil
 }
 
+func (m *MockTerraformExecutor) Show(params []string, envs map[string]string) (string, string, error) {
+	m.Commands = append(m.Commands, RunInfo{"Show", strings.Join(params, " "), time.Now()})
+	return "", "", nil
+}
+
 func (m *MockTerraformExecutor) Plan(params []string, envs map[string]string) (bool, string, string, error) {
 	m.Commands = append(m.Commands, RunInfo{"Plan", strings.Join(params, " "), time.Now()})
 	return true, "", "", nil
@@ -284,7 +289,7 @@ func TestCorrectCommandExecutionWhenPlanning(t *testing.T) {
 
 	commandStrings := allCommandsInOrderWithParams(terraformExecutor, commandRunner, prManager, lock, planStorage, planPathProvider)
 
-	assert.Equal(t, []string{"Init ", "Plan -out plan", "PlanExists plan", "StorePlan plan", "Run   echo"}, commandStrings)
+	assert.Equal(t, []string{"Init ", "Plan -out plan", "PlanExists plan", "StorePlan plan", "Show -no-color -json plan", "Run   echo"}, commandStrings)
 }
 
 func allCommandsInOrderWithParams(terraformExecutor *MockTerraformExecutor, commandRunner *MockCommandRunner, prManager *MockPRManager, lock *MockProjectLock, planStorage *MockPlanStorage, planPathProvider *MockPlanPathProvider) []string {
diff --git a/pkg/policy/policy_test.go b/pkg/policy/policy_test.go
index fdc9b318..6ce493f7 100644
--- a/pkg/policy/policy_test.go
+++ b/pkg/policy/policy_test.go
@@ -1,6 +1,7 @@
 package policy
 
 import (
+	"digger/pkg/core/policy"
 	"digger/pkg/utils"
 	"testing"
 )
@@ -8,7 +9,7 @@ import (
 type OpaExamplePolicyProvider struct {
 }
 
-func (s *OpaExamplePolicyProvider) GetPolicy(_ string, _ string) (string, error) {
+func (s *OpaExamplePolicyProvider) GetAccessPolicy(_ string, _ string) (string, error) {
 	return "package digger\n" +
 		"\n" +
 		"# user-role assignments\n" +
@@ -48,7 +49,7 @@ func (s *OpaExamplePolicyProvider) GetOrganisation() string {
 type DiggerExamplePolicyProvider struct {
 }
 
-func (s *DiggerExamplePolicyProvider) GetPolicy(_ string, _ string, _ string) (string, error) {
+func (s *DiggerExamplePolicyProvider) GetAccessPolicy(_ string, _ string, _ string) (string, error) {
 	return "package digger\n" +
 		"\n" +
 		"user_permissions := {\n" +
@@ -64,6 +65,10 @@ func (s *DiggerExamplePolicyProvider) GetPolicy(_ string, _ string, _ string) (s
 		"", nil
 }
 
+func (s *DiggerExamplePolicyProvider) GetPlanPolicy(_ string, _ string, _ string) (string, error) {
+	return "package digger\n", nil
+}
+
 func (s *DiggerExamplePolicyProvider) GetOrganisation() string {
 	return "ORGANISATIONDIGGER"
 }
@@ -71,7 +76,7 @@ func (s *DiggerExamplePolicyProvider) GetOrganisation() string {
 type DiggerExamplePolicyProvider2 struct {
 }
 
-func (s *DiggerExamplePolicyProvider2) GetPolicy(_ string, _ string, _ string) (string, error) {
+func (s *DiggerExamplePolicyProvider2) GetAccessPolicy(_ string, _ string, _ string) (string, error) {
 	return "package digger\n" +
 		"\n" +
 		"user_permissions := {\n" +
@@ -90,13 +95,17 @@ func (s *DiggerExamplePolicyProvider2) GetPolicy(_ string, _ string, _ string) (
 		"", nil
 }
 
+func (s *DiggerExamplePolicyProvider2) GetPlanPolicy(_ string, _ string, _ string) (string, error) {
+	return "package digger\n\ndeny[sprintf(message, [resource.address])] {\n  message := \"Cannot create EC2 instances!\"\n  resource := input.terraform.resource_changes[_]\n  resource.change.actions[_] == \"create\"\n  resource[type] == \"aws_instance\"\n}\n", nil
+}
+
 func (s *DiggerExamplePolicyProvider2) GetOrganisation() string {
 	return "ORGANISATIONDIGGER"
 }
 
-func TestDiggerPolicyChecker_Check(t *testing.T) {
+func TestDiggerAccessPolicyChecker_Check(t *testing.T) {
 	type fields struct {
-		PolicyProvider PolicyProvider
+		PolicyProvider policy.Provider
 	}
 	type args struct {
 		input interface{}
@@ -159,13 +168,65 @@ func TestDiggerPolicyChecker_Check(t *testing.T) {
 				PolicyProvider: tt.fields.PolicyProvider,
 			}
 			ciService := utils.MockPullRequestManager{Teams: []string{"engineering"}}
-			got, err := p.Check(ciService, tt.organisation, tt.name, tt.name, tt.command, tt.requestedBy)
+			got, err := p.CheckAccessPolicy(ciService, tt.organisation, tt.name, tt.name, tt.command, tt.requestedBy)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("DiggerPolicyChecker.CheckAccessPolicy() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("DiggerPolicyChecker.CheckAccessPolicy() got = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestDiggerPlanPolicyChecker_Check(t *testing.T) {
+	type fields struct {
+		PolicyProvider policy.Provider
+	}
+	type args struct {
+		input interface{}
+	}
+	tests := []struct {
+		name           string
+		planJsonOutput string
+		fields         fields
+		args           args
+		want           bool
+		wantErr        bool
+	}{
+		{
+			name:           "test digger disallow aws instance",
+			planJsonOutput: "{\"format_version\":\"1.2\",\"terraform_version\":\"1.5.2\",\"planned_values\":{\"root_module\":{\"resources\":[{\"address\":\"aws_instance.web\",\"mode\":\"managed\",\"type\":\"aws_instance\",\"name\":\"web\",\"provider_name\":\"registry.terraform.io/hashicorp/aws\",\"schema_version\":1,\"values\":{\"ami\":\"zzz\",\"credit_specification\":[],\"get_password_data\":false,\"hibernation\":null,\"instance_type\":\"t2.micro\",\"launch_template\":[],\"source_dest_check\":true,\"tags\":null,\"timeouts\":null,\"user_data_replace_on_change\":false,\"volume_tags\":null},\"sensitive_values\":{\"capacity_reservation_specification\":[],\"cpu_options\":[],\"credit_specification\":[],\"ebs_block_device\":[],\"enclave_options\":[],\"ephemeral_block_device\":[],\"instance_market_options\":[],\"ipv6_addresses\":[],\"launch_template\":[],\"maintenance_options\":[],\"metadata_options\":[],\"network_interface\":[],\"private_dns_name_options\":[],\"root_block_device\":[],\"secondary_private_ips\":[],\"security_groups\":[],\"tags_all\":{},\"vpc_security_group_ids\":[]}},{\"address\":\"null_resource.test4\",\"mode\":\"managed\",\"type\":\"null_resource\",\"name\":\"test4\",\"provider_name\":\"registry.terraform.io/hashicorp/null\",\"schema_version\":0,\"values\":{\"triggers\":null},\"sensitive_values\":{}}]}},\"resource_changes\":[{\"address\":\"aws_instance.web\",\"mode\":\"managed\",\"type\":\"aws_instance\",\"name\":\"web\",\"provider_name\":\"registry.terraform.io/hashicorp/aws\",\"change\":{\"actions\":[\"create\"],\"before\":null,\"after\":{\"ami\":\"zzz\",\"credit_specification\":[],\"get_password_data\":false,\"hibernation\":null,\"instance_type\":\"t2.micro\",\"launch_template\":[],\"source_dest_check\":true,\"tags\":null,\"timeouts\":null,\"user_data_replace_on_change\":false,\"volume_tags\":null},\"after_unknown\":{\"arn\":true,\"associate_public_ip_address\":true,\"availability_zone\":true,\"capacity_reservation_specification\":true,\"cpu_core_count\":true,\"cpu_options\":true,\"cpu_threads_per_core\":true,\"credit_specification\":[],\"disable_api_stop\":true,\"disable_api_termination\":true,\"ebs_block_device\":true,\"ebs_optimized\":true,\"enclave_options\":true,\"ephemeral_block_device\":true,\"host_id\":true,\"host_resource_group_arn\":true,\"iam_instance_profile\":true,\"id\":true,\"instance_initiated_shutdown_behavior\":true,\"instance_lifecycle\":true,\"instance_market_options\":true,\"instance_state\":true,\"ipv6_address_count\":true,\"ipv6_addresses\":true,\"key_name\":true,\"launch_template\":[],\"maintenance_options\":true,\"metadata_options\":true,\"monitoring\":true,\"network_interface\":true,\"outpost_arn\":true,\"password_data\":true,\"placement_group\":true,\"placement_partition_number\":true,\"primary_network_interface_id\":true,\"private_dns\":true,\"private_dns_name_options\":true,\"private_ip\":true,\"public_dns\":true,\"public_ip\":true,\"root_block_device\":true,\"secondary_private_ips\":true,\"security_groups\":true,\"spot_instance_request_id\":true,\"subnet_id\":true,\"tags_all\":true,\"tenancy\":true,\"user_data\":true,\"user_data_base64\":true,\"vpc_security_group_ids\":true},\"before_sensitive\":false,\"after_sensitive\":{\"capacity_reservation_specification\":[],\"cpu_options\":[],\"credit_specification\":[],\"ebs_block_device\":[],\"enclave_options\":[],\"ephemeral_block_device\":[],\"instance_market_options\":[],\"ipv6_addresses\":[],\"launch_template\":[],\"maintenance_options\":[],\"metadata_options\":[],\"network_interface\":[],\"private_dns_name_options\":[],\"root_block_device\":[],\"secondary_private_ips\":[],\"security_groups\":[],\"tags_all\":{},\"vpc_security_group_ids\":[]}}},{\"address\":\"null_resource.test4\",\"mode\":\"managed\",\"type\":\"null_resource\",\"name\":\"test4\",\"provider_name\":\"registry.terraform.io/hashicorp/null\",\"change\":{\"actions\":[\"create\"],\"before\":null,\"after\":{\"triggers\":null},\"after_unknown\":{\"id\":true},\"before_sensitive\":false,\"after_sensitive\":{}}}],\"configuration\":{\"provider_config\":{\"aws\":{\"name\":\"aws\",\"full_name\":\"registry.terraform.io/hashicorp/aws\"},\"null\":{\"name\":\"null\",\"full_name\":\"registry.terraform.io/hashicorp/null\"}},\"root_module\":{\"resources\":[{\"address\":\"aws_instance.web\",\"mode\":\"managed\",\"type\":\"aws_instance\",\"name\":\"web\",\"provider_config_key\":\"aws\",\"expressions\":{\"ami\":{\"constant_value\":\"zzz\"},\"instance_type\":{\"constant_value\":\"t2.micro\"}},\"schema_version\":1},{\"address\":\"null_resource.test4\",\"mode\":\"managed\",\"type\":\"null_resource\",\"name\":\"test4\",\"provider_config_key\":\"null\",\"schema_version\":0}]}},\"timestamp\":\"2023-07-19T14:55:44Z\"}",
+			fields: fields{
+				PolicyProvider: &DiggerExamplePolicyProvider2{},
+			},
+			want:    false,
+			wantErr: false,
+		},
+		{
+			name:           "test digger allow when there is no aws instance",
+			planJsonOutput: "{\"format_version\":\"1.2\",\"terraform_version\":\"1.5.2\",\"planned_values\":{\"root_module\":{\"resources\":[{\"address\":\"not_an_instance.web\",\"mode\":\"managed\",\"type\":\"not_an_instance\",\"name\":\"web\",\"provider_name\":\"registry.terraform.io/hashicorp/aws\",\"schema_version\":1,\"values\":{\"ami\":\"zzz\",\"credit_specification\":[],\"get_password_data\":false,\"hibernation\":null,\"instance_type\":\"t2.micro\",\"launch_template\":[],\"source_dest_check\":true,\"tags\":null,\"timeouts\":null,\"user_data_replace_on_change\":false,\"volume_tags\":null},\"sensitive_values\":{\"capacity_reservation_specification\":[],\"cpu_options\":[],\"credit_specification\":[],\"ebs_block_device\":[],\"enclave_options\":[],\"ephemeral_block_device\":[],\"instance_market_options\":[],\"ipv6_addresses\":[],\"launch_template\":[],\"maintenance_options\":[],\"metadata_options\":[],\"network_interface\":[],\"private_dns_name_options\":[],\"root_block_device\":[],\"secondary_private_ips\":[],\"security_groups\":[],\"tags_all\":{},\"vpc_security_group_ids\":[]}},{\"address\":\"null_resource.test4\",\"mode\":\"managed\",\"type\":\"null_resource\",\"name\":\"test4\",\"provider_name\":\"registry.terraform.io/hashicorp/null\",\"schema_version\":0,\"values\":{\"triggers\":null},\"sensitive_values\":{}}]}},\"resource_changes\":[{\"address\":\"not_an_instance.lala\",\"mode\":\"managed\",\"type\":\"not_an_instance\",\"name\":\"web\",\"provider_name\":\"registry.terraform.io/hashicorp/aws\",\"change\":{\"actions\":[\"create\"],\"before\":null,\"after\":{\"ami\":\"zzz\",\"credit_specification\":[],\"get_password_data\":false,\"hibernation\":null,\"instance_type\":\"t2.micro\",\"launch_template\":[],\"source_dest_check\":true,\"tags\":null,\"timeouts\":null,\"user_data_replace_on_change\":false,\"volume_tags\":null},\"after_unknown\":{\"arn\":true,\"associate_public_ip_address\":true,\"availability_zone\":true,\"capacity_reservation_specification\":true,\"cpu_core_count\":true,\"cpu_options\":true,\"cpu_threads_per_core\":true,\"credit_specification\":[],\"disable_api_stop\":true,\"disable_api_termination\":true,\"ebs_block_device\":true,\"ebs_optimized\":true,\"enclave_options\":true,\"ephemeral_block_device\":true,\"host_id\":true,\"host_resource_group_arn\":true,\"iam_instance_profile\":true,\"id\":true,\"instance_initiated_shutdown_behavior\":true,\"instance_lifecycle\":true,\"instance_market_options\":true,\"instance_state\":true,\"ipv6_address_count\":true,\"ipv6_addresses\":true,\"key_name\":true,\"launch_template\":[],\"maintenance_options\":true,\"metadata_options\":true,\"monitoring\":true,\"network_interface\":true,\"outpost_arn\":true,\"password_data\":true,\"placement_group\":true,\"placement_partition_number\":true,\"primary_network_interface_id\":true,\"private_dns\":true,\"private_dns_name_options\":true,\"private_ip\":true,\"public_dns\":true,\"public_ip\":true,\"root_block_device\":true,\"secondary_private_ips\":true,\"security_groups\":true,\"spot_instance_request_id\":true,\"subnet_id\":true,\"tags_all\":true,\"tenancy\":true,\"user_data\":true,\"user_data_base64\":true,\"vpc_security_group_ids\":true},\"before_sensitive\":false,\"after_sensitive\":{\"capacity_reservation_specification\":[],\"cpu_options\":[],\"credit_specification\":[],\"ebs_block_device\":[],\"enclave_options\":[],\"ephemeral_block_device\":[],\"instance_market_options\":[],\"ipv6_addresses\":[],\"launch_template\":[],\"maintenance_options\":[],\"metadata_options\":[],\"network_interface\":[],\"private_dns_name_options\":[],\"root_block_device\":[],\"secondary_private_ips\":[],\"security_groups\":[],\"tags_all\":{},\"vpc_security_group_ids\":[]}}},{\"address\":\"null_resource.test4\",\"mode\":\"managed\",\"type\":\"null_resource\",\"name\":\"test4\",\"provider_name\":\"registry.terraform.io/hashicorp/null\",\"change\":{\"actions\":[\"create\"],\"before\":null,\"after\":{\"triggers\":null},\"after_unknown\":{\"id\":true},\"before_sensitive\":false,\"after_sensitive\":{}}}],\"configuration\":{\"provider_config\":{\"aws\":{\"name\":\"aws\",\"full_name\":\"registry.terraform.io/hashicorp/aws\"},\"null\":{\"name\":\"null\",\"full_name\":\"registry.terraform.io/hashicorp/null\"}},\"root_module\":{\"resources\":[{\"address\":\"aws_instance.web\",\"mode\":\"managed\",\"type\":\"aws_instance\",\"name\":\"web\",\"provider_config_key\":\"aws\",\"expressions\":{\"ami\":{\"constant_value\":\"zzz\"},\"instance_type\":{\"constant_value\":\"t2.micro\"}},\"schema_version\":1},{\"address\":\"null_resource.test4\",\"mode\":\"managed\",\"type\":\"null_resource\",\"name\":\"test4\",\"provider_config_key\":\"null\",\"schema_version\":0}]}},\"timestamp\":\"2023-07-19T14:55:44Z\"}",
+			fields: fields{
+				PolicyProvider: &DiggerExamplePolicyProvider2{},
+			},
+			want:    true,
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var p = &DiggerPolicyChecker{
+				PolicyProvider: tt.fields.PolicyProvider,
+			}
+			got, err := p.CheckPlanPolicy("", "", tt.planJsonOutput)
 			if (err != nil) != tt.wantErr {
-				t.Errorf("DiggerPolicyChecker.Check() error = %v, wantErr %v", err, tt.wantErr)
+				t.Errorf("DiggerPolicyChecker.CheckPlanPolicy() error = %v, wantErr %v", err, tt.wantErr)
 				return
 			}
 			if got != tt.want {
-				t.Errorf("DiggerPolicyChecker.Check() got = %v, want %v", got, tt.want)
+				t.Errorf("DiggerPolicyChecker.CheckPlanPolicy() got = %v, want %v", got, tt.want)
 			}
 		})
 	}