Worked on the enterprise-contract/ec-policies repository to deliver secure, compliant build policies focused on Maven build repository URL validation. Developed policy enforcement using Rego, introducing an effective_from metadata annotation to enable a grace period before strict enforcement, which allowed teams to adapt gradually. Configured violations to be reported as warnings prior to the enforcement date, easing the transition to new controls. Enhanced the build validation tooling to support SPDX and CycloneDX SBOM formats, ensuring compatibility with standard software bill-of-materials requirements. The work emphasized policy validation, software security, and traceable, metadata-driven controls to support enterprise-wide adoption and governance.