Guardrails: policies, approvals, templates

Settings → Policies (Admins, per project): allowed runtimes, source/destination types and snapshot modes; the largest size; pipelines per source (each holds a replication slot or log reader); whether "Deploy anyway" exists; whether deploys need approval; which transform types pipelines may use; and whether custom transforms (any SMT class in the image) and scripted transforms (Groovy/JavaScript filter scripts, which run next to the connector's credentials) are allowed — both are off by default. The section groups these by what you decide, refuses an empty allow-list, and before you save lists the running pipelines whose next deploy the change would block. The wizard applies policies up front (disallowed options stay visible and say why); the server enforces them at save and deploy.

With approval required, deploying (including rollbacks and image moves) creates a request with the preflight result; another member with approval rights approves it from the pipeline page (preflight runs again) or rejects it with a comment. Nobody approves their own request.

Templates (History → Save as template) capture a destination, runtime, format, transforms, size and snapshot mode — never tables, column rules, message keys or steps limited to some tables — so teams start from agreed settings.