---
title: "Policy as code"
description: "Policy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember,…"
canonical_url: "https://cloudsmith.com/resources/glossary/policy-as-code"
last_updated: "2026-10-16T14:52:11Z"
---
# Policy as code

## What Is Policy as Code?

Policy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember, the rule is a file that a system evaluates automatically.

## How Policy as Code Works

Rules live in source control and run at decision points:

- Authors write rules in a policy language such as Rego
- Changes go through review and testing like any code
- An engine evaluates each request or artifact against the rules
- The result is allow, deny or flag, with a logged reason

The same input always produces the same decision.

## Why Policy as Code Matters

Manual review cannot keep pace with modern release speed. Policy as code scales enforcement without adding reviewers. It also gives auditors a clear history of what the rules were and when they changed.

## Policy as Code vs Manual Policy

```json
{
  "_key": "15ca5c24-651",
  "_type": "tableBlock",
  "firstRowIsHeader": true,
  "markDefs": null,
  "table": {
    "rows": [
      {
        "_key": "99b14b9c-177",
        "_type": "tableRow",
        "cells": [
          "Aspect",
          "Policy as code",
          "Manual policy"
        ]
      },
      {
        "_key": "a044221c-f05",
        "_type": "tableRow",
        "cells": [
          "Enforcement",
          "Automatic",
          "Depends on people"
        ]
      },
      {
        "_key": "03cf724c-955",
        "_type": "tableRow",
        "cells": [
          "Change history",
          "Versioned",
          "Often undocumented"
        ]
      },
      {
        "_key": "a31729bb-105",
        "_type": "tableRow",
        "cells": [
          "Consistency",
          "Same result every time",
          "Varies by reviewer"
        ]
      }
    ]
  }
}
```

## Final Thought

Policy as code turns intent into enforcement. Teams can move quickly because the guardrails are built in.

## Frequently asked questions

### What languages are used for policy as code?

Rego, used by Open Policy Agent, is common. Other tools use their own domain-specific languages or general-purpose languages.

### Is policy as code only for security?

No. It also covers licensing, access control, cost limits and infrastructure standards.

### Do developers need to write the policies?

Not usually. Security or platform teams author them, and developers work within the guardrails.

### Can policy as code allow exceptions?

Yes. Well-designed policies include documented exceptions or waivers instead of a rigid allow or block.

### How is it tested?

Teams write unit tests with sample inputs and expected decisions, and run them in CI before a policy ships.