[Call For Participation] List of policies we would like to implement with Weaver’s policy engine

[lquerel]

This list aims to:

1. Keep track of the policies identified by the community.
2. Identify the sources of information needed to define the policies in Rego (e.g., semconv before resolution, resolved telemetry schema).

Identified policies:

• We only allow new attribute definitions inside the attribute registry; all other attributes must be references.
• All groups in the attribute registry MUST be of type attribute_group.
• The attribute registry is not allowed to contain references.
• An attribute can only belong to one group.
• Implement a check to prevent referencing the same attribute multiple times within one group (see Detect when the same attribute is referenced more than once #175).
• Checking for naming collisions between namespaces and attribute names (see Add attribute naming checks semantic-conventions#1068).

Please add a new comment to propose new policy ideas. At this stage, do not worry about implementation details. The goal is simply to identify what is missing in the engine and in the currently supported data sources.

[jsuereth]

• A template attribute forms a namespace, and we should not allow attributes below it.
  e.g. http.request.headers.<key> is implied by the template attribute http.request.headers (this may be done by semconv#1068)
• We do not allow the removal of an attribute once added to the registry. It must exist SOMEWHERE in a group.
• We do not allow the removal of a metric name once added to the registry (the group can move around, be deprecated, but its "name" must be exist)

[lquerel]

• A semconv registry greater than or equal to v1.19.0 should not allow optional requirement levels. This requirement_level has been removed between v1.18.0 and v.1.19.0.

Note: we need to find a way to expose the tag or the registry version to the policies one way or another.