From 24779a5c7b4accc0e8d68bb5eb4e585d03e2850d Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Mon, 4 May 2026 16:54:21 -0400
Subject: [PATCH 01/12] [verifier_otel] Add per-target package_policy_id

Make `policy_id`, `policy_name`, and `package_policy_id` `multi: true`
in `manifest.yml`, positionally aligned with `policy_templates`, so a
single verifier_otel package policy can carry per-target-integration
values. Update `input.yml.hbs` to iterate the parallel arrays by index
and emit one `policies[]` entry per target integration, each with
exactly one `integrations[]` entry. `policy_id` may repeat across
entries when target integrations share an agent policy.

Bumps version 0.0.1 -> 0.0.2 and updates policy/system test fixtures
to the new array-valued shape (the policy fixture now exercises two
targets sharing a `policy_id` with distinct `package_policy_id`s).

Refs https://github.com/elastic/security-team/issues/17149
Parent epic https://github.com/elastic/security-team/issues/16847

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../_dev/test/policy/test-eprcheck.expected     |  7 +++++--
 .../_dev/test/policy/test-eprcheck.yml          | 17 ++++++++++++-----
 .../_dev/test/system/test-local-config.yml      | 13 ++++++++-----
 .../verifier_otel/agent/input/input.yml.hbs     | 14 +++++++-------
 packages/verifier_otel/changelog.yml            | 15 +++++++++++++++
 packages/verifier_otel/manifest.yml             | 16 ++++++++--------
 6 files changed, 55 insertions(+), 27 deletions(-)

diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
index d639754edbf..f3c764087da 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
@@ -35,12 +35,15 @@ receivers:
         policies:
             - integrations:
                 - package_name: aws
-                  package_policy_id: test-pp-789
+                  package_policy_id: test-pp-cloudtrail
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: cloudtrail
+              policy_id: test-policy-123
+              policy_name: Verifier-Policy-Test-Connector-abc12345
+            - integrations:
                 - package_name: aws
-                  package_policy_id: test-pp-789
+                  package_policy_id: test-pp-guardduty
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: guardduty
diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
index 469f64149d0..571b8d1adef 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
@@ -9,14 +9,21 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/TestRole
   credentials_external_id: test-external-id
-  # Policy
-  policy_id: test-policy-123
-  policy_name: Verifier-Policy-Test-Connector-abc12345
-  # Integrations (one entry per policy template; package metadata is shared)
+  # Per-target arrays (positionally aligned: index i describes target integration i).
+  # Two targets share the same agent policy but have distinct package_policy_id values.
+  policy_id:
+    - test-policy-123
+    - test-policy-123
+  policy_name:
+    - Verifier-Policy-Test-Connector-abc12345
+    - Verifier-Policy-Test-Connector-abc12345
   policy_templates:
     - cloudtrail
     - guardduty
-  package_policy_id: test-pp-789
+  package_policy_id:
+    - test-pp-cloudtrail
+    - test-pp-guardduty
+  # Package metadata (shared across all targets in this deployment)
   package_name: aws
   package_title: AWS
   package_version: "2.17.0"
diff --git a/packages/verifier_otel/_dev/test/system/test-local-config.yml b/packages/verifier_otel/_dev/test/system/test-local-config.yml
index 32691fd4712..0862d404724 100644
--- a/packages/verifier_otel/_dev/test/system/test-local-config.yml
+++ b/packages/verifier_otel/_dev/test/system/test-local-config.yml
@@ -12,13 +12,16 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/SystemTestRole
   credentials_external_id: system-test-external-id
-  # Policy
-  policy_id: system-test-policy
-  policy_name: Verifier-Policy-System-Test-Connector-abc12345
-  # Integrations (one entry per policy template; package metadata is shared)
+  # Per-target arrays (positionally aligned: index i describes target integration i).
+  policy_id:
+    - system-test-policy
+  policy_name:
+    - Verifier-Policy-System-Test-Connector-abc12345
   policy_templates:
     - cloudtrail
-  package_policy_id: system-test-pp
+  package_policy_id:
+    - system-test-pp
+  # Package metadata (shared across all targets in this deployment)
   package_name: aws
   package_title: AWS
   package_version: "2.17.0"
diff --git a/packages/verifier_otel/agent/input/input.yml.hbs b/packages/verifier_otel/agent/input/input.yml.hbs
index 78472a7d015..b1e16a8321d 100644
--- a/packages/verifier_otel/agent/input/input.yml.hbs
+++ b/packages/verifier_otel/agent/input/input.yml.hbs
@@ -35,16 +35,16 @@ receivers:
           service_account_email: "{{credentials_service_account_email}}"
 {{/if}}
     policies:
-      - policy_id: "{{policy_id}}"
-{{#if policy_name}}
-        policy_name: "{{policy_name}}"
+{{#each policy_id}}
+      - policy_id: "{{this}}"
+{{#if (lookup ../policy_name @index)}}
+        policy_name: "{{lookup ../policy_name @index}}"
 {{/if}}
         integrations:
-{{#each policy_templates}}
-          - policy_template: "{{this}}"
+          - policy_template: "{{lookup ../policy_templates @index}}"
             package_name: "{{../package_name}}"
-{{#if ../package_policy_id}}
-            package_policy_id: "{{../package_policy_id}}"
+{{#if (lookup ../package_policy_id @index)}}
+            package_policy_id: "{{lookup ../package_policy_id @index}}"
 {{/if}}
 {{#if ../package_title}}
             package_title: "{{../package_title}}"
diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index c0deb3645de..765c69cccdf 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -1,4 +1,19 @@
 # newer versions go on top
+- version: "0.2.0"
+  changes:
+    - description: >-
+        Make `policy_id`, `policy_name`, and `package_policy_id` `multi: true`,
+        positionally aligned with `policy_templates`, so a single verifier_otel
+        package policy can carry per-target-integration values.
+      type: breaking-change
+      link: https://github.com/elastic/integrations/pull/18243
+    - description: >-
+        Render one `policies[]` entry per target integration (one index across
+        the parallel arrays), each containing exactly one `integrations[]`
+        entry. `policy_id` may repeat across entries when multiple target
+        integrations share an agent policy.
+      type: breaking-change
+      link: https://github.com/elastic/integrations/pull/18243
 - version: "0.1.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.
diff --git a/packages/verifier_otel/manifest.yml b/packages/verifier_otel/manifest.yml
index 1174a82e377..fee58e8b856 100644
--- a/packages/verifier_otel/manifest.yml
+++ b/packages/verifier_otel/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 3.5.0
 name: verifier_otel
 title: "Permission Verifier"
-version: 0.1.0
+version: 0.2.0
 source:
   license: "Elastic-2.0"
 description: "Verify identity federation based integration permissions and report results to Elasticsearch using the Verifier receiver of the OTel Collector."
@@ -143,28 +143,28 @@ policy_templates:
       - name: policy_id
         type: text
         title: Policy ID
-        description: The agent policy ID for this set of integrations.
-        multi: false
+        description: "Agent policy IDs, positionally aligned with `policy_name`, `package_policy_id`, and `policy_templates`. Entry `i` describes the agent policy that hosts target integration `i`. Values may repeat across entries when multiple target integrations share an agent policy."
+        multi: true
         required: true
         show_user: true
       - name: policy_name
         type: text
         title: Policy Name
-        description: Human-readable name of the policy.
-        multi: false
+        description: "Human-readable agent policy names, positionally aligned with `policy_id`. Entry `i` is the name of the policy referenced by `policy_id[i]`."
+        multi: true
         required: false
         show_user: true
       - name: package_policy_id
         type: text
         title: Package Policy ID
-        description: Unique identifier for the package policy instance.
-        multi: false
+        description: "Unique identifiers for each target integration's package policy instance, positionally aligned with `policy_id`, `policy_name`, and `policy_templates`. Entry `i` is the `package_policy.id` for target integration `i`."
+        multi: true
         required: false
         show_user: true
       - name: policy_templates
         type: text
         title: Policy Templates
-        description: "Policy template names from the integration package (for example, cloudtrail, guardduty, activitylogs). Multiple templates produce one integration entry each, all under the same policy. Combined with package_name to uniquely identify each integration."
+        description: "Policy template names from the integration package (for example, cloudtrail, guardduty, activitylogs), positionally aligned with `policy_id`, `policy_name`, and `package_policy_id`. Entry `i` is the policy template for target integration `i`. Combined with `package_name` to uniquely identify each integration."
         multi: true
         required: true
         show_user: true

From 1503d1d90ff53463939c2e6447d7960259ce64f6 Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Mon, 4 May 2026 17:09:17 -0400
Subject: [PATCH 02/12] [verifier_otel] Revert template/fixture changes; keep
 manifest-only change

Per-target `package_policy_id` is delivered by Kibana creating one
verifier_otel package policy per target integration, not by carrying
parallel arrays in a single package policy. So `input.yml.hbs` and the
test fixtures stay unchanged. Only `manifest.yml` flips `policy_id`,
`policy_name`, and `package_policy_id` to `multi: true`. Changelog
collapsed to a single one-sentence entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../_dev/test/policy/test-eprcheck.expected     |  7 ++-----
 .../_dev/test/policy/test-eprcheck.yml          | 17 +++++------------
 .../_dev/test/system/test-local-config.yml      | 13 +++++--------
 .../verifier_otel/agent/input/input.yml.hbs     | 14 +++++++-------
 packages/verifier_otel/changelog.yml            | 14 ++------------
 5 files changed, 21 insertions(+), 44 deletions(-)

diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
index f3c764087da..d639754edbf 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
@@ -35,15 +35,12 @@ receivers:
         policies:
             - integrations:
                 - package_name: aws
-                  package_policy_id: test-pp-cloudtrail
+                  package_policy_id: test-pp-789
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: cloudtrail
-              policy_id: test-policy-123
-              policy_name: Verifier-Policy-Test-Connector-abc12345
-            - integrations:
                 - package_name: aws
-                  package_policy_id: test-pp-guardduty
+                  package_policy_id: test-pp-789
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: guardduty
diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
index 571b8d1adef..469f64149d0 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
@@ -9,21 +9,14 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/TestRole
   credentials_external_id: test-external-id
-  # Per-target arrays (positionally aligned: index i describes target integration i).
-  # Two targets share the same agent policy but have distinct package_policy_id values.
-  policy_id:
-    - test-policy-123
-    - test-policy-123
-  policy_name:
-    - Verifier-Policy-Test-Connector-abc12345
-    - Verifier-Policy-Test-Connector-abc12345
+  # Policy
+  policy_id: test-policy-123
+  policy_name: Verifier-Policy-Test-Connector-abc12345
+  # Integrations (one entry per policy template; package metadata is shared)
   policy_templates:
     - cloudtrail
     - guardduty
-  package_policy_id:
-    - test-pp-cloudtrail
-    - test-pp-guardduty
-  # Package metadata (shared across all targets in this deployment)
+  package_policy_id: test-pp-789
   package_name: aws
   package_title: AWS
   package_version: "2.17.0"
diff --git a/packages/verifier_otel/_dev/test/system/test-local-config.yml b/packages/verifier_otel/_dev/test/system/test-local-config.yml
index 0862d404724..32691fd4712 100644
--- a/packages/verifier_otel/_dev/test/system/test-local-config.yml
+++ b/packages/verifier_otel/_dev/test/system/test-local-config.yml
@@ -12,16 +12,13 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/SystemTestRole
   credentials_external_id: system-test-external-id
-  # Per-target arrays (positionally aligned: index i describes target integration i).
-  policy_id:
-    - system-test-policy
-  policy_name:
-    - Verifier-Policy-System-Test-Connector-abc12345
+  # Policy
+  policy_id: system-test-policy
+  policy_name: Verifier-Policy-System-Test-Connector-abc12345
+  # Integrations (one entry per policy template; package metadata is shared)
   policy_templates:
     - cloudtrail
-  package_policy_id:
-    - system-test-pp
-  # Package metadata (shared across all targets in this deployment)
+  package_policy_id: system-test-pp
   package_name: aws
   package_title: AWS
   package_version: "2.17.0"
diff --git a/packages/verifier_otel/agent/input/input.yml.hbs b/packages/verifier_otel/agent/input/input.yml.hbs
index b1e16a8321d..78472a7d015 100644
--- a/packages/verifier_otel/agent/input/input.yml.hbs
+++ b/packages/verifier_otel/agent/input/input.yml.hbs
@@ -35,16 +35,16 @@ receivers:
           service_account_email: "{{credentials_service_account_email}}"
 {{/if}}
     policies:
-{{#each policy_id}}
-      - policy_id: "{{this}}"
-{{#if (lookup ../policy_name @index)}}
-        policy_name: "{{lookup ../policy_name @index}}"
+      - policy_id: "{{policy_id}}"
+{{#if policy_name}}
+        policy_name: "{{policy_name}}"
 {{/if}}
         integrations:
-          - policy_template: "{{lookup ../policy_templates @index}}"
+{{#each policy_templates}}
+          - policy_template: "{{this}}"
             package_name: "{{../package_name}}"
-{{#if (lookup ../package_policy_id @index)}}
-            package_policy_id: "{{lookup ../package_policy_id @index}}"
+{{#if ../package_policy_id}}
+            package_policy_id: "{{../package_policy_id}}"
 {{/if}}
 {{#if ../package_title}}
             package_title: "{{../package_title}}"
diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index 765c69cccdf..51994402643 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -1,19 +1,9 @@
 # newer versions go on top
 - version: "0.2.0"
   changes:
-    - description: >-
-        Make `policy_id`, `policy_name`, and `package_policy_id` `multi: true`,
-        positionally aligned with `policy_templates`, so a single verifier_otel
-        package policy can carry per-target-integration values.
-      type: breaking-change
-      link: https://github.com/elastic/integrations/pull/18243
-    - description: >-
-        Render one `policies[]` entry per target integration (one index across
-        the parallel arrays), each containing exactly one `integrations[]`
-        entry. `policy_id` may repeat across entries when multiple target
-        integrations share an agent policy.
+    - description: "Make `policy_id`, `policy_name`, and `package_policy_id` `multi: true`."
       type: breaking-change
-      link: https://github.com/elastic/integrations/pull/18243
+      link: https://github.com/elastic/integrations/pull/18786
 - version: "0.1.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.

From 9d71ae549f1d40b7de184dbf221f4aff5326f197 Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Mon, 4 May 2026 17:22:31 -0400
Subject: [PATCH 03/12] [verifier_otel] Revert manifest descriptions; keep
 multi:true flips only

Net diff vs main is now: three `multi: false` -> `multi: true` flips on
`policy_id`, `policy_name`, and `package_policy_id`, plus the 0.0.1 ->
0.0.2 version bump and one-line changelog entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/verifier_otel/manifest.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/verifier_otel/manifest.yml b/packages/verifier_otel/manifest.yml
index fee58e8b856..d2ec7677f41 100644
--- a/packages/verifier_otel/manifest.yml
+++ b/packages/verifier_otel/manifest.yml
@@ -143,28 +143,28 @@ policy_templates:
       - name: policy_id
         type: text
         title: Policy ID
-        description: "Agent policy IDs, positionally aligned with `policy_name`, `package_policy_id`, and `policy_templates`. Entry `i` describes the agent policy that hosts target integration `i`. Values may repeat across entries when multiple target integrations share an agent policy."
+        description: The agent policy ID for this set of integrations.
         multi: true
         required: true
         show_user: true
       - name: policy_name
         type: text
         title: Policy Name
-        description: "Human-readable agent policy names, positionally aligned with `policy_id`. Entry `i` is the name of the policy referenced by `policy_id[i]`."
+        description: Human-readable name of the policy.
         multi: true
         required: false
         show_user: true
       - name: package_policy_id
         type: text
         title: Package Policy ID
-        description: "Unique identifiers for each target integration's package policy instance, positionally aligned with `policy_id`, `policy_name`, and `policy_templates`. Entry `i` is the `package_policy.id` for target integration `i`."
+        description: Unique identifier for the package policy instance.
         multi: true
         required: false
         show_user: true
       - name: policy_templates
         type: text
         title: Policy Templates
-        description: "Policy template names from the integration package (for example, cloudtrail, guardduty, activitylogs), positionally aligned with `policy_id`, `policy_name`, and `package_policy_id`. Entry `i` is the policy template for target integration `i`. Combined with `package_name` to uniquely identify each integration."
+        description: "Policy template names from the integration package (for example, cloudtrail, guardduty, activitylogs). Multiple templates produce one integration entry each, all under the same policy. Combined with package_name to uniquely identify each integration."
         multi: true
         required: true
         show_user: true

From a3f382da0b84dc5c0b5db4a20b41e02c1cba39dd Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Mon, 4 May 2026 17:29:11 -0400
Subject: [PATCH 04/12] [verifier_otel] Reclassify changelog entry as
 enhancement

`multi: false` -> `multi: true` is a value-set widening: every input the
field previously accepted is still accepted, and Fleet auto-coerces
saved scalar values to single-element arrays on upgrade. The template
and fixtures are unchanged so rendered output is byte-identical for
existing single-target deployments. No user action is required, which
is the signature of `enhancement` rather than `breaking-change`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/verifier_otel/changelog.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index 51994402643..4df67fc2d96 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -2,7 +2,7 @@
 - version: "0.2.0"
   changes:
     - description: "Make `policy_id`, `policy_name`, and `package_policy_id` `multi: true`."
-      type: breaking-change
+      type: enhancement
       link: https://github.com/elastic/integrations/pull/18786
 - version: "0.1.0"
   changes:

From 9e9b5afd88c2c48f9ce9ecf0ff04037b0a907157 Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Tue, 5 May 2026 11:07:13 -0400
Subject: [PATCH 05/12] [verifier_otel] Replace per-policy vars with a single
 `policies` yaml var

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../_dev/test/policy/test-eprcheck.expected   |  7 ++-
 .../_dev/test/policy/test-eprcheck.yml        | 30 +++++++----
 .../_dev/test/system/test-local-config.yml    | 20 +++----
 .../verifier_otel/agent/input/input.yml.hbs   |  2 +
 packages/verifier_otel/changelog.yml          |  4 +-
 packages/verifier_otel/manifest.yml           | 54 +++----------------
 6 files changed, 46 insertions(+), 71 deletions(-)

diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
index d639754edbf..f3c764087da 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
@@ -35,12 +35,15 @@ receivers:
         policies:
             - integrations:
                 - package_name: aws
-                  package_policy_id: test-pp-789
+                  package_policy_id: test-pp-cloudtrail
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: cloudtrail
+              policy_id: test-policy-123
+              policy_name: Verifier-Policy-Test-Connector-abc12345
+            - integrations:
                 - package_name: aws
-                  package_policy_id: test-pp-789
+                  package_policy_id: test-pp-guardduty
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: guardduty
diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
index 469f64149d0..b7c87bf30af 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
@@ -9,14 +9,22 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/TestRole
   credentials_external_id: test-external-id
-  # Policy
-  policy_id: test-policy-123
-  policy_name: Verifier-Policy-Test-Connector-abc12345
-  # Integrations (one entry per policy template; package metadata is shared)
-  policy_templates:
-    - cloudtrail
-    - guardduty
-  package_policy_id: test-pp-789
-  package_name: aws
-  package_title: AWS
-  package_version: "2.17.0"
+  # Policies — one entry per target integration. policy_id repeats because both
+  # targets live on the same agent policy; package_policy_id distinguishes them.
+  policies: |
+    - policy_id: test-policy-123
+      policy_name: Verifier-Policy-Test-Connector-abc12345
+      policy_templates:
+        - cloudtrail
+      package_name: aws
+      package_policy_id: test-pp-cloudtrail
+      package_title: AWS
+      package_version: "2.17.0"
+    - policy_id: test-policy-123
+      policy_name: Verifier-Policy-Test-Connector-abc12345
+      policy_templates:
+        - guardduty
+      package_name: aws
+      package_policy_id: test-pp-guardduty
+      package_title: AWS
+      package_version: "2.17.0"
diff --git a/packages/verifier_otel/_dev/test/system/test-local-config.yml b/packages/verifier_otel/_dev/test/system/test-local-config.yml
index 32691fd4712..9ac73fb3dfd 100644
--- a/packages/verifier_otel/_dev/test/system/test-local-config.yml
+++ b/packages/verifier_otel/_dev/test/system/test-local-config.yml
@@ -12,13 +12,13 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/SystemTestRole
   credentials_external_id: system-test-external-id
-  # Policy
-  policy_id: system-test-policy
-  policy_name: Verifier-Policy-System-Test-Connector-abc12345
-  # Integrations (one entry per policy template; package metadata is shared)
-  policy_templates:
-    - cloudtrail
-  package_policy_id: system-test-pp
-  package_name: aws
-  package_title: AWS
-  package_version: "2.17.0"
+  # Policies — single target.
+  policies: |
+    - policy_id: system-test-policy
+      policy_name: Verifier-Policy-System-Test-Connector-abc12345
+      policy_templates:
+        - cloudtrail
+      package_name: aws
+      package_policy_id: system-test-pp
+      package_title: AWS
+      package_version: "2.17.0"
diff --git a/packages/verifier_otel/agent/input/input.yml.hbs b/packages/verifier_otel/agent/input/input.yml.hbs
index 78472a7d015..11025d75548 100644
--- a/packages/verifier_otel/agent/input/input.yml.hbs
+++ b/packages/verifier_otel/agent/input/input.yml.hbs
@@ -35,6 +35,7 @@ receivers:
           service_account_email: "{{credentials_service_account_email}}"
 {{/if}}
     policies:
+{{#each policies}}
       - policy_id: "{{policy_id}}"
 {{#if policy_name}}
         policy_name: "{{policy_name}}"
@@ -53,6 +54,7 @@ receivers:
             package_version: "{{../package_version}}"
 {{/if}}
 {{/each}}
+{{/each}}
 
 service:
   pipelines:
diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index 4df67fc2d96..4d915339f80 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -1,8 +1,8 @@
 # newer versions go on top
 - version: "0.2.0"
   changes:
-    - description: "Make `policy_id`, `policy_name`, and `package_policy_id` `multi: true`."
-      type: enhancement
+    - description: "Replace per-policy vars with a single `policies` `type: yaml` var holding a list of policy objects, and loop the rendered `policies[]` block over it."
+      type: breaking-change
       link: https://github.com/elastic/integrations/pull/18786
 - version: "0.1.0"
   changes:
diff --git a/packages/verifier_otel/manifest.yml b/packages/verifier_otel/manifest.yml
index d2ec7677f41..697f0e2bf90 100644
--- a/packages/verifier_otel/manifest.yml
+++ b/packages/verifier_otel/manifest.yml
@@ -140,55 +140,17 @@ policy_templates:
         multi: false
         required: false
         show_user: true
-      - name: policy_id
-        type: text
-        title: Policy ID
-        description: The agent policy ID for this set of integrations.
-        multi: true
-        required: true
-        show_user: true
-      - name: policy_name
-        type: text
-        title: Policy Name
-        description: Human-readable name of the policy.
-        multi: true
-        required: false
-        show_user: true
-      - name: package_policy_id
-        type: text
-        title: Package Policy ID
-        description: Unique identifier for the package policy instance.
-        multi: true
-        required: false
-        show_user: true
-      - name: policy_templates
-        type: text
-        title: Policy Templates
-        description: "Policy template names from the integration package (for example, cloudtrail, guardduty, activitylogs). Multiple templates produce one integration entry each, all under the same policy. Combined with package_name to uniquely identify each integration."
-        multi: true
-        required: true
-        show_user: true
-      - name: package_name
-        type: text
-        title: Package Name
-        description: "Integration package name (for example, aws, azure, gcp, okta)."
+      - name: policies
+        type: yaml
+        title: Policies
+        description: "List of verifier policies to evaluate. Each entry describes one agent policy and the target integrations to verify under it. To get distinct `package_policy_id` per target, emit one entry per target (with a single-element `policy_templates`); `policy_id` may repeat when targets share an agent policy."
         multi: false
         required: true
         show_user: true
-      - name: package_title
-        type: text
-        title: Package Title
-        description: "Human-readable title of the integration package (for example, AWS, Azure, GCP)."
-        multi: false
-        required: false
-        show_user: true
-      - name: package_version
-        type: text
-        title: Package Version
-        description: "Semantic version of the integration package (for example, 2.17.0). Different versions might require different permissions. When empty, the latest permission set is used."
-        multi: false
-        required: false
-        show_user: true
+        default: |
+          - policy_id: ""
+            policy_templates: []
+            package_name: ""
 owner:
   github: elastic/cloud-services
   type: elastic

From 71c3334ee354dff06dce487df964f45e3237aaf5 Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Tue, 5 May 2026 11:25:45 -0400
Subject: [PATCH 06/12] [verifier_otel] Keep legacy per-policy vars for
 backward compat

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../verifier_otel/agent/input/input.yml.hbs   | 21 +++++++
 packages/verifier_otel/changelog.yml          |  4 +-
 packages/verifier_otel/manifest.yml           | 57 +++++++++++++++++--
 3 files changed, 74 insertions(+), 8 deletions(-)

diff --git a/packages/verifier_otel/agent/input/input.yml.hbs b/packages/verifier_otel/agent/input/input.yml.hbs
index 11025d75548..4afbbf93642 100644
--- a/packages/verifier_otel/agent/input/input.yml.hbs
+++ b/packages/verifier_otel/agent/input/input.yml.hbs
@@ -35,6 +35,7 @@ receivers:
           service_account_email: "{{credentials_service_account_email}}"
 {{/if}}
     policies:
+{{#if policies}}
 {{#each policies}}
       - policy_id: "{{policy_id}}"
 {{#if policy_name}}
@@ -55,6 +56,26 @@ receivers:
 {{/if}}
 {{/each}}
 {{/each}}
+{{else}}
+      - policy_id: "{{policy_id}}"
+{{#if policy_name}}
+        policy_name: "{{policy_name}}"
+{{/if}}
+        integrations:
+{{#each policy_templates}}
+          - policy_template: "{{this}}"
+            package_name: "{{../package_name}}"
+{{#if ../package_policy_id}}
+            package_policy_id: "{{../package_policy_id}}"
+{{/if}}
+{{#if ../package_title}}
+            package_title: "{{../package_title}}"
+{{/if}}
+{{#if ../package_version}}
+            package_version: "{{../package_version}}"
+{{/if}}
+{{/each}}
+{{/if}}
 
 service:
   pipelines:
diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index 4d915339f80..fe50ebf514e 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -1,8 +1,8 @@
 # newer versions go on top
 - version: "0.2.0"
   changes:
-    - description: "Replace per-policy vars with a single `policies` `type: yaml` var holding a list of policy objects, and loop the rendered `policies[]` block over it."
-      type: breaking-change
+    - description: "Add `policies` `type: yaml` var holding a list of policy objects; when set, the template iterates it and emits one rendered `policies[]` entry per object. Existing per-policy scalar vars stay supported as a fallback."
+      type: enhancement
       link: https://github.com/elastic/integrations/pull/18786
 - version: "0.1.0"
   changes:
diff --git a/packages/verifier_otel/manifest.yml b/packages/verifier_otel/manifest.yml
index 697f0e2bf90..625607d2314 100644
--- a/packages/verifier_otel/manifest.yml
+++ b/packages/verifier_otel/manifest.yml
@@ -140,17 +140,62 @@ policy_templates:
         multi: false
         required: false
         show_user: true
+      - name: policy_id
+        type: text
+        title: Policy ID
+        description: The agent policy ID for this set of integrations.
+        multi: false
+        required: false
+        show_user: true
+      - name: policy_name
+        type: text
+        title: Policy Name
+        description: Human-readable name of the policy.
+        multi: false
+        required: false
+        show_user: true
+      - name: package_policy_id
+        type: text
+        title: Package Policy ID
+        description: Unique identifier for the package policy instance.
+        multi: false
+        required: false
+        show_user: true
+      - name: policy_templates
+        type: text
+        title: Policy Templates
+        description: "Policy template names from the integration package (for example, cloudtrail, guardduty, activitylogs). Multiple templates produce one integration entry each, all under the same policy. Combined with package_name to uniquely identify each integration."
+        multi: true
+        required: false
+        show_user: true
+      - name: package_name
+        type: text
+        title: Package Name
+        description: "Integration package name (for example, aws, azure, gcp, okta)."
+        multi: false
+        required: false
+        show_user: true
+      - name: package_title
+        type: text
+        title: Package Title
+        description: "Human-readable title of the integration package (for example, AWS, Azure, GCP)."
+        multi: false
+        required: false
+        show_user: true
+      - name: package_version
+        type: text
+        title: Package Version
+        description: "Semantic version of the integration package (for example, 2.17.0). Different versions might require different permissions. When empty, the latest permission set is used."
+        multi: false
+        required: false
+        show_user: true
       - name: policies
         type: yaml
         title: Policies
-        description: "List of verifier policies to evaluate. Each entry describes one agent policy and the target integrations to verify under it. To get distinct `package_policy_id` per target, emit one entry per target (with a single-element `policy_templates`); `policy_id` may repeat when targets share an agent policy."
+        description: "List of verifier policies to evaluate. Each entry describes one agent policy and the target integrations to verify under it. To get distinct `package_policy_id` per target, emit one entry per target (with a single-element `policy_templates`); `policy_id` may repeat when targets share an agent policy. When set, takes precedence over the per-policy scalar vars."
         multi: false
-        required: true
+        required: false
         show_user: true
-        default: |
-          - policy_id: ""
-            policy_templates: []
-            package_name: ""
 owner:
   github: elastic/cloud-services
   type: elastic

From 71d9d1d0c69220d7a5a8e7e07736d2d7c8b8180a Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Tue, 5 May 2026 11:35:35 -0400
Subject: [PATCH 07/12] [verifier_otel] Drop legacy scalar fallback in template

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../verifier_otel/agent/input/input.yml.hbs   | 21 -------------------
 1 file changed, 21 deletions(-)

diff --git a/packages/verifier_otel/agent/input/input.yml.hbs b/packages/verifier_otel/agent/input/input.yml.hbs
index 4afbbf93642..11025d75548 100644
--- a/packages/verifier_otel/agent/input/input.yml.hbs
+++ b/packages/verifier_otel/agent/input/input.yml.hbs
@@ -35,7 +35,6 @@ receivers:
           service_account_email: "{{credentials_service_account_email}}"
 {{/if}}
     policies:
-{{#if policies}}
 {{#each policies}}
       - policy_id: "{{policy_id}}"
 {{#if policy_name}}
@@ -56,26 +55,6 @@ receivers:
 {{/if}}
 {{/each}}
 {{/each}}
-{{else}}
-      - policy_id: "{{policy_id}}"
-{{#if policy_name}}
-        policy_name: "{{policy_name}}"
-{{/if}}
-        integrations:
-{{#each policy_templates}}
-          - policy_template: "{{this}}"
-            package_name: "{{../package_name}}"
-{{#if ../package_policy_id}}
-            package_policy_id: "{{../package_policy_id}}"
-{{/if}}
-{{#if ../package_title}}
-            package_title: "{{../package_title}}"
-{{/if}}
-{{#if ../package_version}}
-            package_version: "{{../package_version}}"
-{{/if}}
-{{/each}}
-{{/if}}
 
 service:
   pipelines:

From 7257a8605e91ee0a16c02b75b3fc34a8e4ccc302 Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Tue, 5 May 2026 19:25:32 -0400
Subject: [PATCH 08/12] [verifier_otel] Inline policies yaml var directly;
 producer now sends receiver shape

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../_dev/test/policy/test-eprcheck.expected   |  3 --
 .../_dev/test/policy/test-eprcheck.yml        | 29 +++++++++----------
 .../_dev/test/system/test-local-config.yml    | 14 ++++-----
 .../verifier_otel/agent/input/input.yml.hbs   | 21 +-------------
 4 files changed, 21 insertions(+), 46 deletions(-)

diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
index f3c764087da..22ab8616004 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
@@ -39,9 +39,6 @@ receivers:
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: cloudtrail
-              policy_id: test-policy-123
-              policy_name: Verifier-Policy-Test-Connector-abc12345
-            - integrations:
                 - package_name: aws
                   package_policy_id: test-pp-guardduty
                   package_title: AWS
diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
index b7c87bf30af..5408d195ca2 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
@@ -9,22 +9,19 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/TestRole
   credentials_external_id: test-external-id
-  # Policies — one entry per target integration. policy_id repeats because both
-  # targets live on the same agent policy; package_policy_id distinguishes them.
+  # Policies in receiver shape — Kibana producer constructs this directly.
+  # Two targets share one agent policy: one `policies[]` entry, two `integrations[]`.
   policies: |
     - policy_id: test-policy-123
       policy_name: Verifier-Policy-Test-Connector-abc12345
-      policy_templates:
-        - cloudtrail
-      package_name: aws
-      package_policy_id: test-pp-cloudtrail
-      package_title: AWS
-      package_version: "2.17.0"
-    - policy_id: test-policy-123
-      policy_name: Verifier-Policy-Test-Connector-abc12345
-      policy_templates:
-        - guardduty
-      package_name: aws
-      package_policy_id: test-pp-guardduty
-      package_title: AWS
-      package_version: "2.17.0"
+      integrations:
+        - policy_template: cloudtrail
+          package_name: aws
+          package_policy_id: test-pp-cloudtrail
+          package_title: AWS
+          package_version: "2.17.0"
+        - policy_template: guardduty
+          package_name: aws
+          package_policy_id: test-pp-guardduty
+          package_title: AWS
+          package_version: "2.17.0"
diff --git a/packages/verifier_otel/_dev/test/system/test-local-config.yml b/packages/verifier_otel/_dev/test/system/test-local-config.yml
index 9ac73fb3dfd..d2fa1159c8b 100644
--- a/packages/verifier_otel/_dev/test/system/test-local-config.yml
+++ b/packages/verifier_otel/_dev/test/system/test-local-config.yml
@@ -12,13 +12,13 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/SystemTestRole
   credentials_external_id: system-test-external-id
-  # Policies — single target.
+  # Policies in receiver shape — single target.
   policies: |
     - policy_id: system-test-policy
       policy_name: Verifier-Policy-System-Test-Connector-abc12345
-      policy_templates:
-        - cloudtrail
-      package_name: aws
-      package_policy_id: system-test-pp
-      package_title: AWS
-      package_version: "2.17.0"
+      integrations:
+        - policy_template: cloudtrail
+          package_name: aws
+          package_policy_id: system-test-pp
+          package_title: AWS
+          package_version: "2.17.0"
diff --git a/packages/verifier_otel/agent/input/input.yml.hbs b/packages/verifier_otel/agent/input/input.yml.hbs
index 11025d75548..76089b41618 100644
--- a/packages/verifier_otel/agent/input/input.yml.hbs
+++ b/packages/verifier_otel/agent/input/input.yml.hbs
@@ -35,26 +35,7 @@ receivers:
           service_account_email: "{{credentials_service_account_email}}"
 {{/if}}
     policies:
-{{#each policies}}
-      - policy_id: "{{policy_id}}"
-{{#if policy_name}}
-        policy_name: "{{policy_name}}"
-{{/if}}
-        integrations:
-{{#each policy_templates}}
-          - policy_template: "{{this}}"
-            package_name: "{{../package_name}}"
-{{#if ../package_policy_id}}
-            package_policy_id: "{{../package_policy_id}}"
-{{/if}}
-{{#if ../package_title}}
-            package_title: "{{../package_title}}"
-{{/if}}
-{{#if ../package_version}}
-            package_version: "{{../package_version}}"
-{{/if}}
-{{/each}}
-{{/each}}
+{{policies}}
 
 service:
   pipelines:

From 88f43710a4658132aa3100e8eb019488699c6bf2 Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Tue, 5 May 2026 20:41:17 -0400
Subject: [PATCH 09/12] [verifier_otel] Switch all per-target vars to parallel
 multi:true text arrays

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../_dev/test/policy/test-eprcheck.expected   |  3 ++
 .../_dev/test/policy/test-eprcheck.yml        | 39 +++++++++++--------
 .../_dev/test/system/test-local-config.yml    | 25 +++++++-----
 .../verifier_otel/agent/input/input.yml.hbs   | 19 ++++++++-
 packages/verifier_otel/changelog.yml          |  2 +-
 packages/verifier_otel/manifest.yml           | 39 ++++++++-----------
 6 files changed, 76 insertions(+), 51 deletions(-)

diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
index 22ab8616004..f3c764087da 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
@@ -39,6 +39,9 @@ receivers:
                   package_title: AWS
                   package_version: "2.17.0"
                   policy_template: cloudtrail
+              policy_id: test-policy-123
+              policy_name: Verifier-Policy-Test-Connector-abc12345
+            - integrations:
                 - package_name: aws
                   package_policy_id: test-pp-guardduty
                   package_title: AWS
diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
index 5408d195ca2..1b3e8d6b26c 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.yml
@@ -9,19 +9,26 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/TestRole
   credentials_external_id: test-external-id
-  # Policies in receiver shape — Kibana producer constructs this directly.
-  # Two targets share one agent policy: one `policies[]` entry, two `integrations[]`.
-  policies: |
-    - policy_id: test-policy-123
-      policy_name: Verifier-Policy-Test-Connector-abc12345
-      integrations:
-        - policy_template: cloudtrail
-          package_name: aws
-          package_policy_id: test-pp-cloudtrail
-          package_title: AWS
-          package_version: "2.17.0"
-        - policy_template: guardduty
-          package_name: aws
-          package_policy_id: test-pp-guardduty
-          package_title: AWS
-          package_version: "2.17.0"
+  # Per-target arrays (positionally aligned: index i describes target integration i).
+  # Both targets share the same agent policy; package_policy_id distinguishes them.
+  policy_id:
+    - test-policy-123
+    - test-policy-123
+  policy_name:
+    - Verifier-Policy-Test-Connector-abc12345
+    - Verifier-Policy-Test-Connector-abc12345
+  policy_templates:
+    - cloudtrail
+    - guardduty
+  package_policy_id:
+    - test-pp-cloudtrail
+    - test-pp-guardduty
+  package_name:
+    - aws
+    - aws
+  package_title:
+    - AWS
+    - AWS
+  package_version:
+    - "2.17.0"
+    - "2.17.0"
diff --git a/packages/verifier_otel/_dev/test/system/test-local-config.yml b/packages/verifier_otel/_dev/test/system/test-local-config.yml
index d2fa1159c8b..9a38b15e62f 100644
--- a/packages/verifier_otel/_dev/test/system/test-local-config.yml
+++ b/packages/verifier_otel/_dev/test/system/test-local-config.yml
@@ -12,13 +12,18 @@ vars:
   # Credentials
   credentials_role_arn: arn:aws:iam::123456789012:role/SystemTestRole
   credentials_external_id: system-test-external-id
-  # Policies in receiver shape — single target.
-  policies: |
-    - policy_id: system-test-policy
-      policy_name: Verifier-Policy-System-Test-Connector-abc12345
-      integrations:
-        - policy_template: cloudtrail
-          package_name: aws
-          package_policy_id: system-test-pp
-          package_title: AWS
-          package_version: "2.17.0"
+  # Per-target arrays (positionally aligned: index i describes target integration i).
+  policy_id:
+    - system-test-policy
+  policy_name:
+    - Verifier-Policy-System-Test-Connector-abc12345
+  policy_templates:
+    - cloudtrail
+  package_policy_id:
+    - system-test-pp
+  package_name:
+    - aws
+  package_title:
+    - AWS
+  package_version:
+    - "2.17.0"
diff --git a/packages/verifier_otel/agent/input/input.yml.hbs b/packages/verifier_otel/agent/input/input.yml.hbs
index 76089b41618..1c04b40a5da 100644
--- a/packages/verifier_otel/agent/input/input.yml.hbs
+++ b/packages/verifier_otel/agent/input/input.yml.hbs
@@ -35,7 +35,24 @@ receivers:
           service_account_email: "{{credentials_service_account_email}}"
 {{/if}}
     policies:
-{{policies}}
+{{#each policy_id}}
+      - policy_id: "{{this}}"
+{{#if (lookup ../policy_name @index)}}
+        policy_name: "{{lookup ../policy_name @index}}"
+{{/if}}
+        integrations:
+          - policy_template: "{{lookup ../policy_templates @index}}"
+            package_name: "{{lookup ../package_name @index}}"
+{{#if (lookup ../package_policy_id @index)}}
+            package_policy_id: "{{lookup ../package_policy_id @index}}"
+{{/if}}
+{{#if (lookup ../package_title @index)}}
+            package_title: "{{lookup ../package_title @index}}"
+{{/if}}
+{{#if (lookup ../package_version @index)}}
+            package_version: "{{lookup ../package_version @index}}"
+{{/if}}
+{{/each}}
 
 service:
   pipelines:
diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index fe50ebf514e..68c70b4bd9c 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -1,7 +1,7 @@
 # newer versions go on top
 - version: "0.2.0"
   changes:
-    - description: "Add `policies` `type: yaml` var holding a list of policy objects; when set, the template iterates it and emits one rendered `policies[]` entry per object. Existing per-policy scalar vars stay supported as a fallback."
+    - description: "Render one `policies[]` entry per target via parallel `multi: true` arrays (`policy_id`, `policy_name`, `policy_templates`, `package_policy_id`, `package_name`, `package_title`, `package_version`)."
       type: enhancement
       link: https://github.com/elastic/integrations/pull/18786
 - version: "0.1.0"
diff --git a/packages/verifier_otel/manifest.yml b/packages/verifier_otel/manifest.yml
index 625607d2314..0934e5606d8 100644
--- a/packages/verifier_otel/manifest.yml
+++ b/packages/verifier_otel/manifest.yml
@@ -143,57 +143,50 @@ policy_templates:
       - name: policy_id
         type: text
         title: Policy ID
-        description: The agent policy ID for this set of integrations.
-        multi: false
-        required: false
+        description: The agent policy IDs, positionally aligned with `policy_name`, `policy_templates`, and `package_policy_id`. Entry `i` describes target integration `i`.
+        multi: true
+        required: true
         show_user: true
       - name: policy_name
         type: text
         title: Policy Name
-        description: Human-readable name of the policy.
-        multi: false
+        description: Human-readable agent policy names, positionally aligned with `policy_id`.
+        multi: true
         required: false
         show_user: true
       - name: package_policy_id
         type: text
         title: Package Policy ID
-        description: Unique identifier for the package policy instance.
-        multi: false
+        description: Target package policy IDs, positionally aligned with `policy_id`.
+        multi: true
         required: false
         show_user: true
       - name: policy_templates
         type: text
         title: Policy Templates
-        description: "Policy template names from the integration package (for example, cloudtrail, guardduty, activitylogs). Multiple templates produce one integration entry each, all under the same policy. Combined with package_name to uniquely identify each integration."
+        description: Target policy template names, positionally aligned with `policy_id`.
         multi: true
-        required: false
+        required: true
         show_user: true
       - name: package_name
         type: text
         title: Package Name
-        description: "Integration package name (for example, aws, azure, gcp, okta)."
-        multi: false
-        required: false
+        description: "Target package names (for example, aws, azure, gcp, okta), positionally aligned with `policy_id`."
+        multi: true
+        required: true
         show_user: true
       - name: package_title
         type: text
         title: Package Title
-        description: "Human-readable title of the integration package (for example, AWS, Azure, GCP)."
-        multi: false
+        description: "Human-readable target package titles, positionally aligned with `policy_id`."
+        multi: true
         required: false
         show_user: true
       - name: package_version
         type: text
         title: Package Version
-        description: "Semantic version of the integration package (for example, 2.17.0). Different versions might require different permissions. When empty, the latest permission set is used."
-        multi: false
-        required: false
-        show_user: true
-      - name: policies
-        type: yaml
-        title: Policies
-        description: "List of verifier policies to evaluate. Each entry describes one agent policy and the target integrations to verify under it. To get distinct `package_policy_id` per target, emit one entry per target (with a single-element `policy_templates`); `policy_id` may repeat when targets share an agent policy. When set, takes precedence over the per-policy scalar vars."
-        multi: false
+        description: "Target package versions, positionally aligned with `policy_id`. When empty, the latest permission set is used."
+        multi: true
         required: false
         show_user: true
 owner:

From e9564870dd4199a5790342bccf44247fbdcdbbe6 Mon Sep 17 00:00:00 2001
From: Lola <omolola.akinleye@elastic.co>
Date: Wed, 13 May 2026 16:09:38 -0400
Subject: [PATCH 10/12] [verifier_otel] Bump to 0.1.0; require Kibana ^9.5.0

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 packages/verifier_otel/changelog.yml | 3 +++
 packages/verifier_otel/manifest.yml  | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index 68c70b4bd9c..53bfec3cc74 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -4,6 +4,9 @@
     - description: "Render one `policies[]` entry per target via parallel `multi: true` arrays (`policy_id`, `policy_name`, `policy_templates`, `package_policy_id`, `package_name`, `package_title`, `package_version`)."
       type: enhancement
       link: https://github.com/elastic/integrations/pull/18786
+    - description: "Require Kibana 9.5.0+ (`conditions.kibana.version: ^9.5.0`) so multi-target policy compilation is available at install time."
+      type: breaking-change
+      link: https://github.com/elastic/integrations/pull/18786
 - version: "0.1.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.
diff --git a/packages/verifier_otel/manifest.yml b/packages/verifier_otel/manifest.yml
index 0934e5606d8..52250bba0db 100644
--- a/packages/verifier_otel/manifest.yml
+++ b/packages/verifier_otel/manifest.yml
@@ -13,7 +13,7 @@ categories:
   - cloud
 conditions:
   kibana:
-    version: "^9.3.0"
+    version: "^9.5.0"
   elastic:
     subscription: "basic"
 icons:

From 7116128d3a8b5ad26d7a5c7733ee91d4d06b7c69 Mon Sep 17 00:00:00 2001
From: Sean Rathier <sean.rathier@elastic.co>
Date: Fri, 3 Jul 2026 14:48:32 -0400
Subject: [PATCH 11/12] [verifier_otel] Update test-eprcheck.expected for
 Kibana 9.5.0 OTel policy compiler output

Bumping conditions.kibana.version to ^9.5.0 changed which Kibana version
CI tests against (9.5.0-SNAPSHOT, resolved as the oldest version
satisfying the constraint). That version's OTel agent-policy compiler
assigns a component ID to the generic forward connector/pipeline too,
shifting our receiver's pipeline from componentid-0 to componentid-1,
and adds nil-guards to the transform processor's set() statements. The
policies: payload itself is unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../_dev/test/policy/test-eprcheck.expected        | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
index f3c764087da..71f66de74a4 100644
--- a/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
+++ b/packages/verifier_otel/_dev/test/policy/test-eprcheck.expected
@@ -1,5 +1,5 @@
 connectors:
-    forward: {}
+    forward/componentid-0: {}
 exporters:
     elasticsearch/componentid-0:
         endpoints:
@@ -25,8 +25,8 @@ processors:
             - context: log
               statements:
                 - set(attributes["data_stream.type"], "logs")
-                - set(attributes["data_stream.dataset"], "verifierreceiver")
-                - set(attributes["data_stream.namespace"], "ep")
+                - set(attributes["data_stream.dataset"], "verifierreceiver") where attributes["data_stream.dataset"] == nil
+                - set(attributes["data_stream.namespace"], "ep") where attributes["data_stream.namespace"] == nil
 receivers:
     verifier/componentid-0:
         account_type: single-account
@@ -60,14 +60,14 @@ secret_references:
     - {}
 service:
     pipelines:
-        logs:
+        logs/componentid-0:
             exporters:
                 - elasticsearch/componentid-0
             receivers:
-                - forward
-        logs/componentid-0:
+                - forward/componentid-0
+        logs/componentid-1:
             exporters:
-                - forward
+                - forward/componentid-0
             processors:
                 - transform/componentid-0
             receivers:

From 9d47a757f64b7df841a3f78468d9785409ebbdc1 Mon Sep 17 00:00:00 2001
From: Sean Rathier <sean.rathier@elastic.co>
Date: Fri, 3 Jul 2026 14:50:46 -0400
Subject: [PATCH 12/12] [verifier_otel] Point changelog links at PR #19965

The original PR (#18786) was superseded by #19965 after a rebase to
resolve conflicts with main.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 packages/verifier_otel/changelog.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/verifier_otel/changelog.yml b/packages/verifier_otel/changelog.yml
index 53bfec3cc74..51e3ef203e0 100644
--- a/packages/verifier_otel/changelog.yml
+++ b/packages/verifier_otel/changelog.yml
@@ -3,10 +3,10 @@
   changes:
     - description: "Render one `policies[]` entry per target via parallel `multi: true` arrays (`policy_id`, `policy_name`, `policy_templates`, `package_policy_id`, `package_name`, `package_title`, `package_version`)."
       type: enhancement
-      link: https://github.com/elastic/integrations/pull/18786
+      link: https://github.com/elastic/integrations/pull/19965
     - description: "Require Kibana 9.5.0+ (`conditions.kibana.version: ^9.5.0`) so multi-target policy compilation is available at install time."
       type: breaking-change
-      link: https://github.com/elastic/integrations/pull/18786
+      link: https://github.com/elastic/integrations/pull/19965
 - version: "0.1.0"
   changes:
     - description: Use new `release` field for agentless deployment mode to establish as beta.