Update service 630 directs processing system 650 to identify a committed change in one or more files associated with a CNF in a first repository. Once a committed change is made, which may include updating one or more files, adding one or more files, or removing one or more files, update service 630 directs processing system 650 to determine whether the committed change is permitted based on one or more policies associated with the CNF. In some examples, each CNF may include or be associated with a policy that can indicate files or portions of files that cannot be modified by a developer. Accordingly, if a modification is not permitted based on the policy, the modification will not be implemented in the downstream repository. However, if the modification is permitted, update service may update one or more files in the second repository based on the committed change. The update may include adding, removing, replacing, or some other operation to implement the modification.

In some examples, in addition to or in place of using the policy file to determine whether a modification is permitted, update service 632 may determine whether a modification is permitted based on the developer committing the change. For example, a developer may commit a modification to the file associated with a CNF. When the modification is identified in the first repository, update service 632 may identify a developer associated with the committed modification and determine whether the developer is permitted to make the modification based on one or more policy rules.