Policy as code
What Is Policy as Code?
Policy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember, the rule is a file that a system evaluates automatically.
How Policy as Code Works
Rules live in source control and run at decision points:
- Authors write rules in a policy language such as Rego
- Changes go through review and testing like any code
- An engine evaluates each request or artifact against the rules
- The result is allow, deny or flag, with a logged reason
The same input always produces the same decision.
Why Policy as Code Matters
Manual review cannot keep pace with modern release speed. Policy as code scales enforcement without adding reviewers. It also gives auditors a clear history of what the rules were and when they changed.
Policy as Code vs Manual Policy
| Aspect | Policy as code | Manual policy |
|---|---|---|
| Enforcement | Automatic | Depends on people |
| Change history | Versioned | Often undocumented |
| Consistency | Same result every time | Varies by reviewer |
Final Thought
Policy as code turns intent into enforcement. Teams can move quickly because the guardrails are built in.
Frequently asked questions
What languages are used for policy as code?
Rego, used by Open Policy Agent, is common. Other tools use their own domain-specific languages or general-purpose languages.
Is policy as code only for security?
No. It also covers licensing, access control, cost limits and infrastructure standards.
Do developers need to write the policies?
Not usually. Security or platform teams author them, and developers work within the guardrails.
Can policy as code allow exceptions?
Yes. Well-designed policies include documented exceptions or waivers instead of a rigid allow or block.
How is it tested?
Teams write unit tests with sample inputs and expected decisions, and run them in CI before a policy ships.