Policy-as-Code

Policies are written to define the desired state of a system, not the step-by-step procedure to achieve it. The policy engine is responsible for reconciling the current state with the declared intent.

• Example: An OPA rule states allow = true only if input.request.region == "EU", rather than scripting a series of firewall commands.
• This separation of intent from implementation makes policies auditable and less prone to procedural bugs.

Policy definitions are stored as plain-text files in a Git repository, treating them with the same rigor as application source code.

• Enables GitOps workflows where policy changes trigger automated testing pipelines.
• Provides a complete, immutable audit trail of who changed a rule, when, and why via commit history.
• Allows for rollback to a previous policy set instantly if a newly deployed rule causes a production outage.

A policy engine evaluates rules against structured data (JSON) in real-time, decoupled from the applications it governs.

• Architecture: Applications query the engine via API at decision points (e.g., API gateway authorization, Terraform plan validation).
• Latency: Decisions are typically returned in < 5 milliseconds, enabling inline enforcement without degrading user experience.
• Eliminates manual "click-ops" misconfigurations by programmatically rejecting non-compliant infrastructure changes before deployment.

Every rule can be validated with unit tests before deployment, proving it behaves correctly under all conditions.

• Test fixtures provide mock input data to simulate both compliant and non-compliant scenarios.
• A robust test suite prevents regressions, ensuring a fix for one vulnerability doesn't inadvertently permit another.
• This transforms security policy from a static document into a verifiable, executable specification.

PaC leverages high-level, purpose-built languages like Rego (for OPA) or Sentinel (for HashiCorp) rather than general-purpose scripting.

• These DSLs are designed for reasoning about hierarchical, structured data and have no arbitrary side effects.
• Rego Example: count(violations) == 0 is a simple, readable expression that can query deeply nested JSON paths.
• This focus drastically reduces the attack surface compared to embedding a full Turing-complete language like Python for policy decisions.

A single policy engine can enforce rules across the entire heterogeneous stack, from Kubernetes admission control to CI/CD pipelines and API authorization.

• Context-Aware: The same engine can make different decisions based on input.attributes like user role, resource tags, or geolocation.
• This collapses fragmented, siloed security tools into one logical control plane, ensuring a consistent security posture and dramatically reducing operational overhead.