Techniques are disclosed for governed or constrained deployment of one or more applications on trusted infrastructure of a cloud infrastructure environment. For example, a repository of metadata (e.g., metadata lake) is maintained. The metadata repository includes metadata associated with applications, metadata associated with content associated with the applications, and metadata associated with a cloud infrastructure environment in which the applications are deployable. A deployment is determined for a given application on a trusted infrastructure within the cloud infrastructure environment based on at least a subset of the metadata maintained in the metadata repository. The determination of the deployment of the given application based on the subset of the metadata includes mapping trust-based criteria associated with the given application with a portion of infrastructure of the cloud infrastructure environment that satisfies the trust-based criteria.