Is Ratify a policy engine?

[cmaclaughlin]

The README describes Ratify as "a policy engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment only those that comply with policies you create.". I realize Ratify includes a policy provider, but policy engine reads as something a bit more robust, like OPA. I thought the previous description -- "Ratify provides a framework" -- was a good/logical one since it emphasized extensibility and composability.

Has there been a shift in what Ratify is supposed to be or did I misunderstand the original intent?

[sajayantony]

This should be reworded as Ratify is a verification framework. +1 on calling this out.
@cmaclaughlin