# Policy as code

## What Is Policy as Code?

Policy as code is the practice of writing security and compliance rules as versioned, machine-enforceable code. Instead of a document that people must remember, the rule is a file that a system evaluates automatically.

## How Policy as Code Works

Rules live in source control and run at decision points:

- Authors write rules in a policy language such as Rego
- Changes go through review and testing like any code
- An engine evaluates each request or artifact against the rules
- The result is allow, deny or flag, with a logged reason

The same input always produces the same decision.

## Why Policy as Code Matters

Manual review cannot keep pace with modern release speed. Policy as code scales enforcement without adding reviewers. It also gives auditors a clear history of what the rules were and when they changed.

## Policy as Code vs Manual Policy

| Aspect              | Policy as code | Manual policy           |
|---------------------|-----------------|-------------------------|
| Enforcement          | Automatic       | Depends on people       |
| Change history       | Versioned       | Often undocumented       |
| Consistency          | Same result every time | Varies by reviewer |

## Final Thought

Policy as code turns intent into enforcement. Teams can move quickly because the guardrails are built in.

## Frequently asked questions

### What languages are used for policy as code?

Rego, used by Open Policy Agent, is common. Other tools use their own domain-specific languages or general-purpose languages.

### Is policy as code only for security?

No. It also covers licensing, access control, cost limits and infrastructure standards.

### Do developers need to write the policies?

Not usually. Security or platform teams author them, and developers work within the guardrails.

### Can policy as code allow exceptions?

Yes. Well-designed policies include documented exceptions or waivers instead of a rigid allow or block.

### How is it tested?

Teams write unit tests with sample inputs and expected decisions, and run them in CI before a policy ships.

Qualified