All articles
Product Updates
New Feature: Run the Right Guidelines in the Right Places with Advanced Scan Policies
Advanced Scan Policies are now live in Pandorian. Engineering leaders can define exactly which paths to ignore, scope guideline groups to specific directories or repos, and override org-level defaults for…
TL;DR: Advanced Scan Policies are now live in Pandorian. Engineering leaders can define exactly which paths to ignore, scope guideline groups to specific directories or repos, and override org-level defaults for individual repositories. For large organizations, strategic and precise enforcement is now part of the governance layer.
Running the same rules across your entire codebase sounds thorough. It isn’t.
Your test files shouldn’t fail security checks. Your generated code shouldn’t trigger architecture guidelines. Your legacy monolith shouldn’t be held to the same conventions as a greenfield microservice built last quarter.
At 10 engineers, blanket enforcement is manageable. At 100+, it creates friction, alert fatigue, and the worst outcome in governance: developers who stop paying attention to violations because most of them are irrelevant.
Scan Policies fix this. They give engineering leaders precise control over where guidelines run, what gets excluded, and how individual repositories behave relative to org-wide defaults.
Blanket Enforcement Was Never Built for Large Orgs
Engineering standards enforcement at scale requires precision, not blanket rules applied uniformly across every file and directory in the codebase.
The bigger the organization, the more varied the codebase. You have production services and throwaway scripts. Stable infrastructure and actively evolving features. Payment processing services that need PCI compliance checks and internal tooling that doesn’t. Legacy repositories with conventions that predate your current standards by years.
When enforcement treats all of these the same, the signal gets buried in noise. Teams start ignoring violations because most of them are not relevant to them. That’s not a developer behavior problem. That’s a configuration problem.
Tell Pandorian What to Ignore, and Mean It
Ignored paths let engineering leaders exclude test fixtures, generated code, and vendor directories from all guideline checks across the entire organization.
Test files. Generated code. Vendor libraries. These paths shouldn’t be subject to enforcement. Not because the standards don’t matter, but because enforcing them there produces no useful signal and creates noise that drowns out real violations.
With Scan Policies, you add ignored path patterns once at the organization level. Pandorian applies those exclusions across all guidelines, every scan, without any per-guideline configuration required. Define it once. It holds everywhere.
Put the Right Guidelines in the Right Places
Guideline scoping restricts enforcement to specific paths or repositories, so compliance rules run only on the code they were written for.
Not every guideline belongs everywhere. This is not a workaround. It’s correct governance.
A scoping rule lets you restrict a guideline group, by tag, to specific paths or repos. Guidelines tagged pci-compliance run only against payment processing code. Guidelines tagged auth enforce strictly within /src/auth. Every other part of the codebase is unaffected.
The result: higher signal, less noise, and developers who act on violations because those violations are relevant to their work.
When One Repo Needs Its Own Rules
Repository overrides let engineering leaders customize scan policy per repository, overriding organization-level defaults where a specific repo has different conventions or requirements.
Org-level defaults handle the common case. Repository overrides handle the exceptions, and in large organizations, exceptions are not rare.
A legacy repo with third-party code. A repo where tests are the only place certain patterns are enforced. A recent acquisition following different conventions until migration is complete. These repos need their own scan policy, without changing what applies everywhere else.
Set a repository override, and Pandorian uses those settings for that repo while the org policy remains intact for everything else.
Your Codebase Has Structure. Now Your Governance Does Too.
Scan Policies give engineering organizations precise control over which guidelines run, where they run, and how organization defaults are overridden for individual repositories. Rules that run everywhere produce noise. Rules that run where they belong produce compliance.
Scan Policies make Pandorian aware of your organization’s actual structure: which paths to exclude, which guideline groups belong in which corners of the codebase, and which repositories are exceptions to the org-level rule.
This is governance that reflects the organization you actually run. Not a generic enforcement layer applied uniformly to a codebase it doesn’t understand.
Navigate to Scan Policies in the Pandorian dashboard to configure.
Common Questions
What types of paths can I ignore with Scan Policies?
Scan Policies support glob patterns for ignored paths. Common use cases include test directories, generated code, vendor dependencies, and fixture data. Ignored paths are set at the organization level and apply across all guidelines automatically, with no per-guideline configuration required.
Can I scope guidelines to specific repositories, not just file paths?
Yes. Guideline scoping rules let you restrict a guideline group, by tag, to specific paths or repositories. You can target enforcement at the service level, the directory level, or a specific repo, while every other repository remains unaffected.
How does a repository override interact with the org-level scan policy?
Repository overrides take precedence over org-level defaults for the repositories they cover. If your org policy excludes test files but a specific repo requires the opposite, the override controls that repo without changing the policy for anything else in the organization.
Does adding scoping rules slow down scans?
No. Scoping rules limit where guidelines run, which reduces the volume of checks per scan. In large codebases, well-configured Scan Policies typically improve scan efficiency by removing unnecessary checks on paths or services where those guidelines don’t apply.
Written by Amit Kochman, GTM Operations Director at Pandorian
Related Reading
More articles to read
Introducing: The Enforceable Engineering Standards Library.
Pandorian introduces the first enforceable engineering standards library, built from patterns already proven inside large-scale, production-grade codebases. Over 1,000 guidelines across more than 100 packages...
Feature Highlight: Guidelines as Code, So Your AI and Your Enforcement Read the Same File
The markdown file your AI coding assistant reads, a CLAUDE.md, an AGENTS.md, a Cursor rules file, was never guaranteed to match what your enforcement platform actually checked. Guidelines as Code...
