Canva Integration Policy Guardrails

Overview

Encode high-confidence invariants close to the code and verify them again at runtime. Keep provider-dependent facts versioned so a stale numeric limit or preview assumption cannot become permanent policy.

Prerequisites

• Policy document, owner, enforcement scope, and exception expiry
• Repository/runtime boundaries and pinned provider contract
• Current secret, scope, data, CI-event, and preview inventory

Instructions

Step 1: Classify controls

Separate immutable security controls from versioned provider-contract checks and local operational thresholds. Name the authority for each.

Step 2: Add secret controls