policy as code
also: PaC, policy-as-code, infrastructure policy
Policy as code is the practice of defining infrastructure, security, and operational rules as machine-readable code rather than documentation, enabling automated enforcement and version control.
Policy as code treats organizational policies—such as security standards, compliance requirements, and configuration rules—as executable code that systems automatically validate and enforce. Instead of writing policies in documents that humans must interpret and manually implement, you codify them in languages like Rego, HCL, or YAML that tools can parse and apply consistently.
Common use cases include container image scanning (e.g., Kyverno or Falco preventing unauthorized images), infrastructure validation (Terraform policy enforcement), and access control (ABAC policies in services like OPA). For example, a policy might automatically reject any Kubernetes pod that doesn't specify resource limits, or block deployments to production without approved security scans.
Benefits include consistency across environments, auditability, faster feedback loops, and the ability to treat policies like software—reviewing them in pull requests, testing changes, and rolling them back if needed.