policy as code

Scan plan JSON on every pull request, run new rules advisory for two weeks, and block only what is law. Waivers live in version control with an owner and an expiry date, or the gate becomes noise within a quarter.

The reframe that scores: many controls contain machine-checkable assertions; others require human evidence. Guardrails prevent, gates stop pipelines, drift detection watches live state, and evidence falls out as a byproduct.

Exceptions rot when they lack expiry dates, named owners and an aggregate view. Structured records where engineers work, auto-expiry with teeth, and a monthly portfolio review that treats growth as a control failure.

The instinct is to build a portal. The ticket mix decides whether a portal helps at all, and most teams never count it.

Generated infrastructure code is plausible, fluent and confidently wrong in specific ways. The volume goes up, the reviewer attention per line goes down, and the controls that used to be optional stop being optional.