Loading...
Rules that enforce themselves: governance written in code and run by machines.
Quick Definition
Policy as code expresses governance and compliance rules in machine-readable files that can be version-controlled and automatically enforced. It brings consistency, auditability, and automation to policy, catching violations early in pipelines rather than after deployment.
Policy as code is the practice of expressing organizational rules in machine-readable form and enforcing them automatically. Instead of a document saying production resources must be tagged with an owner, a policy engine evaluates every deployment and rejects the ones that break the rule, instantly and consistently.
The approach inherits software's whole toolkit: policies are version-controlled, reviewed in pull requests, tested against examples, and rolled out gradually. Enforcement points sit wherever change happens, in CI/CD pipelines checking infrastructure code before it applies, in Kubernetes admission control, and in cloud-native engines watching live environments.
Example. A policy blocks any storage bucket configured for public access unless it carries an approved exception tag. The rule fires twelve times in its first quarter, each one a potential breach prevented at a cost of zero human review hours.
Cost rules deserve the same treatment as security rules: size ceilings, mandatory tags, region restrictions, and expiry labels all enforce well as code. Tools like Open Policy Agent lead the space. See Opslyft Cost Governance and the infrastructure as code primer for the enforcement foundation.
Open Policy Agent is the general-purpose standard; clouds offer native engines, and Kubernetes uses admission controllers such as Kyverno.
As early as possible: at code review and pipeline time for prevention, with runtime checks as the safety net for drift.
Mandatory ownership tags, instance size and type allowlists, region restrictions, and expiry labels on temporary resources.