Can CrossGuard somehow work when not using the service?

Yes - the

--policy-pack

flag can be passed to

up

and

preivew

to run a local policy pack as part of an update. The guide at https://www.pulumi.com/docs/guides/crossguard/ walks through using this.

ah okay, I read that. I assume the advantage of the service is that the policies can be applied "globally" and are checked independent of the infra developer "knowing" about them. Right? One team creates and publishes the policies and it impacts the whole org? Without the service it's up to the person writing the infra to add the policy to their repo and to add

--policy-pack

to the commands. No enforcement.

That's exactly right.

👍 great argument to pay for a good service

💰