New company policy

content/en/docs/control-center/security/policies.md

@@ -8,7 +8,6 @@ weight: 30
 ## Introduction
 
 Policies help ensure that your app landscape is secure, compliant, and consistent. On the **Policies** page, you can define policies that your apps need to adhere to. If they do not, violations are automatically detected and reported in Software Composition, allowing you to react accordingly. For details on how policy violations are displayed in Software Composition, refer to [Policy Status](/control-center/policy-status/).
-
 The **Policies** page allows you to create new policies, lists all of your existing policies, and displays a **Help & Support** pane with useful information about creating policies.
 
 ## Defining Policies
@@ -17,13 +16,14 @@ You can define policies by either using a template or starting from scratch. The
 
 ### Creating a Policy From a Template
 
-You can use one of the existing templates to create your own policy. 
+You can use one of the existing templates to create your own policy.
 
 1. Click **Create from Template**.
 
 2. Select one of the available templates:
 
-    * Only allow Marketplace components that are platform-supported
+    * Only company-approved components are allowed
+    * Only platform-supported Marketplace components are allowed
     * Only medium or low findings are allowed
     * Only Mendix runtime versions >= 9.24.43 are allowed
 
@@ -46,19 +46,16 @@ You can create a policy by defining your own details.
     * **Policy Name** – A relevant name for your policy, such as one indicating what the policy checks.
     * **Description** – A description of the goal of the policy, which covers why it needs to be adhered to, and how to fix its violations.
     * **Policy Conditions** – Define the conditions under which the policy is considered violated. These are the available conditions and their values:
-
         * **Any finding severity is** – Choose which severity level violates the policy. You can select one or more of the following values:
 
             * **LOW**
             * **MEDIUM**
             * **HIGH**
             * **CRITICAL**
-
             For example, if you select **CRITICAL**, apps with critical findings violate this policy.
 
         * **Mendix runtime version is lower than** – Indicate which Mendix version is the minimum that your apps must use.
-
-        * **Marketplace component license is not** – Select the licenses that are acceptable. If a Marketplace component has a license which is not one of the ones you select here, the policy is violated. These are the possible values:
+        * **Marketplace component license is not** and **Marketplace component license is** – Select the licenses that are acceptable. If a Marketplace component has a license which is not one of the ones you select here, the policy is violated. These are the possible values:
 
             * MIT
             * BSD_2_0
@@ -70,13 +67,16 @@ You can create a policy by defining your own details.
             * GNU_GENERAL_PUBLIC_LICENSE_V3
             * MENDIX_MARKETPLACE_CONTENT_TERMS
 
-        * **Marketplace component support is not** – Select the support types that are acceptable. If a Marketplace component has a support type which is not one of the ones you select here, the policy is violated. These are the possible values:
+        * **Marketplace component support is not** and **Marketplace component support is** – Select the support types that are acceptable. If a Marketplace component has a support type which is not one of the ones you select here, the policy is violated. These are the possible values:
 
             * PARTNER
             * SIEMENS
             * PLATFORM
             * COMMUNITY
 
+        * **Marketplace component is not Company-approved** – Choose to only allow company-approved components. This enables you to have granular control over the components in your app based on curation settings. Curation settings let you specify the criteria that Marketplace components must meet in order to get a company-approved badge, as well as exceptions for specific components. You can define these settings on the **Company-Approved** page of the **Marketplace** section in Control Center. For details, refer to [Company-Approved](/control-center/company-approved/).    
+            If you choose to define this policy, you no longer need to also define other license or support policies.
+
     * **Checkpoints & Action(s)** – Select the trigger which causes the policy to be checked, and the action that is taken if the policy is violated. Currently, policy violations are checked at the time of package creation, and violations generate warnings.
 
 3. On the **Policy Scope** tab, select whether you want the policy to apply to all licensed apps, or only to specific apps in your environment.

content/en/docs/releasenotes/control-center/2026.md

@@ -9,6 +9,12 @@ numberless_headings: true
 
 ## October 2026
 
+### October 29, 2026
+
+#### New Features
+
+* We have added the **Marketplace component is not Company-approved** policy to [Policies](/control-center/policies/). This policy lets you only allow company-approved components in your apps. Along with this new policy type, we have also added a matching policy template.
+
 ### October 8, 2026
 
 #### Improvements