Policy as Code
Expressing governance rules as executable code evaluated automatically, so compliance is prevented at creation rather than reported after the fact.
Manual review does not scale to cloud's rate of change, and a monthly report of violations is a detective control that arrives after the exposure. Policy as code shifts enforcement earlier.
Three enforcement points, and mature estates use all of them. Pre-deployment, in the pipeline, where infrastructure code is evaluated before apply — the cheapest place to fail, because nothing has been created. Admission, where the platform refuses a non-compliant resource at creation — the strongest, since it cannot be bypassed by anyone deploying another way. Runtime, scanning what exists to catch drift and anything created outside the pipeline.
Tooling: Open Policy Agent and Rego as the general standard, provider-native services (SCPs, Azure Policy, Organization Policy), and Kubernetes admission controllers such as Kyverno or Gatekeeper.
The properties that make a policy set usable rather than resented: clear failure messages naming the rule and how to comply, since an opaque denial burns hours; a documented exception path, because a policy with no exceptions gets disabled entirely the first time it blocks something urgent; and rollout in audit mode first, to discover how much existing infrastructure would fail before turning it on.
The additional benefit in regulated environments is evidence: automated policy produces a continuous, queryable compliance record rather than an annual reconstruction.