The owner's paths

sensitive.yml lists the paths that always need the owner's go, whatever the class of the work. A change that touches one of them waits for the owner.

The default

.mandately/sensitive.yml

# Paths that always need the owner's go, whatever the class.
go_paths:
  - ".mandately/*"          # the policy itself
  - ".github/workflows/*"   # what CI runs and with which rights
  - "infra/*"

The rules themselves are among them, so changing a rule needs the owner's go too.

Settings

`go_paths`

Path patterns, matched against every path a change touches:

* matches any characters, slashes included, so infra/* covers everything under infra/.
? matches one character.
[ab] matches one of the characters inside.

A pattern without a wildcard matches that one file.

Change it

Your deploy configuration and the Dockerfile now wait for the owner too:

.mandately/sensitive.yml

go_paths:
  - ".mandately/*"
  - ".github/workflows/*"
  - "infra/*"
  - "deploy/*"
  - "Dockerfile"

Keep .mandately/* in the list, or a change to your rules could merge without the owner.