Policy as Code: Rules as Versioned, Testable Code

Why it exists

Manually configuring security and compliance rules across complex, distributed systems is slow, error-prone, and impossible to scale. As infrastructure became code, the rules governing that infrastructure also needed to become code to keep pace and ensure consistency.

The mental model

Treat your policies—security rules, compliance checks, cost controls—exactly like you treat your application code. They should live in a version control system like Git, be subject to code review via pull requests, have automated tests, and be deployed through a CI/CD pipeline. Instead of a human clicking buttons in a console to, say, prevent public S3 buckets, a machine enforces a rule written in a declarative language.

How it works

You choose a policy engine (like Open Policy Agent - OPA) and a policy language (like Rego). You write policies that define the desired state or constraints, such as "all container images must come from our trusted registry." These policies are then integrated at key points in the software lifecycle. This could be a CI pipeline step that fails a build, a Kubernetes admission controller that rejects a deployment, or an API gateway that denies a request. The engine evaluates incoming configurations against the policies and returns a simple allow/deny decision.

When to use it

Use PaC when you need to enforce consistent guardrails at scale, especially in multi-cloud or hybrid environments. It is critical for regulated industries that require auditable proof of compliance. Key use cases include pre-deployment checks in CI/CD, Kubernetes admission control, and continuous compliance scanning of cloud resources.

When not to use it

PaC can be overkill for small, simple systems with a high-trust team where manual configuration is manageable. It introduces a new dependency—the policy engine—and a learning curve for the policy language. If your rules are simple and static, and your team lacks the skills to manage policy as code, a simpler approach may be better.

One canonical example

A platform team uses Open Policy Agent (OPA) as a Kubernetes admission controller. A developer tries to deploy a service using an image from a public, untrusted repository. The Kubernetes API server forwards the request to OPA, which evaluates it against a policy stating "all images must originate from our company's private registry." Since the image is from an untrusted source, OPA returns a "deny" decision, the API server rejects the deployment, and the developer receives an immediate, automated message explaining the failure.