A trust policy is a rule set that decides which packages, maintainers, or signatures a system will accept as trustworthy. In software supply chains, it can require a valid signature, a known publisher identity, a verified provenance claim, or an allowlist of approved sources before installation or release.
This matters because package managers and CI systems often execute code during install, so trusting the wrong artifact can turn a routine update into code execution. In attacks, a malicious gem or other dependency may be accepted if policy checks are weak, missing, or bypassed. In defense, trust policies help reduce risk from typosquatting, account takeover, and poisoned dependencies by forcing verification instead of blind install. Strong policies are usually paired with signature validation, trusted publishing, short-lived credentials, and monitoring for unusual install events.