> Markdown version of [/videos/532-policy-as-versioned-code-you-re-doing-it-wrong?t=1811](https://www.wearedevelopers.com/videos/532-policy-as-versioned-code-you-re-doing-it-wrong?t=1811). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Policy as [versioned] code - you're doing it wrong

Writing rules in YAML isn't true policy as code. Stop breaking CI pipelines and start treating compliance as a visible, version-controlled software dependency.

- **Speakers:** Chris Nesbitt-Smith
- **Event:** WeAreDevelopers LIVE
- **Published:** October 19, 2022
- **Duration:** 45:57
- **URL:** https://www.wearedevelopers.com/videos/532-policy-as-versioned-code-you-re-doing-it-wrong

## Summary

Organizations often treat internal policies as bureaucratic, hidden rules that developers only discover when continuous integration pipelines fail. This opaque "computer says no" approach results in deployment downtime, reverse-engineered workarounds, and deep frustration among engineering teams. While many organizations believe they are implementing policy as code simply by defining security or formatting rules in YAML, this purely syntactical shift often fails to resolve the underlying cultural and communication issues.

To genuinely fix compliance workflows, teams should treat policy as a visible, testable software dependency. By storing policies in shared version control alongside explicit semantic versioning, organizations can seamlessly distribute updates and prevent unannounced breakages. Because these policies behave like standard dependencies, developers gain the ability to validate infrastructure configurations locally and rely on automated update platforms like GitHub Dependabot or Mend Renovate. This process transitions rule enforcement from an abrupt deployment block to a straightforward, collaborative pull request.

Shifting from reactionary, emotionally-driven compliance to proportionate risk mitigation requires policies to carry a robust and defensible logical purpose. Leveraging ecosystems like Terraform with Checkov or Kubernetes with Kyverno allows engineering teams to measure real-time compliance practically across an entire estate while still accommodating legacy systems that rely on older policy version branches. Resolving this gap between intent and application ensures better overall software supply chain visibility and reinforces the reality that a policy without clear purpose easily becomes a pointless bottleneck.

**Keywords:** policy as code, semantic versioning, ci/cd policy enforcement, software supply chain visibility, infrastructure compliance checks, automated dependency updates, github dependabot, mend renovate, terraform checkov integration, kubernetes kyverno implementation, risk mitigation culture, shift-left security tools, open policy agent (opa), local compliance evaluation, gitops policy workflows

## Chapters

1. **Elevator pitch analogy for policy management** (00:02) — A fictional elevator scenario illustrates the pain points of policy enforcement among executives, product managers, and developers.
1. **Core promises of policy as versioned code** (04:46) — Treating policy as a versioned dependency enables faster updates, local compliance checks, and clear communication.
1. **Common pitfalls in implementing policy as code** (07:48) — Hiding security policies from developers leads to reverse-engineered constraints, broken deployments, and brittle case law exemptions.
1. **Managing policies exactly like standard software dependencies** (11:47) — Making policy source code visible and applying semantic versioning allows automatic compliance updates via standard continuous integration tools.
1. **Code demonstration using terraform and kubernetes** (16:23) — Evaluating semantic policy versions systematically across environments relies on localized validation and active admission controllers.
1. **Connecting policy rules directly to business risk** (20:50) — Policies must carry a clear risk narrative to prevent agile product teams from treating them as unnecessary friction.
1. **Addressing cultural resistance to compliance policy controls** (24:13) — Tangible risk communication prevents teams from viewing essential policies as bureaucratic hurdles.
1. **Evaluating risk scenarios across cheaper cloud providers** (26:12) — Using smaller cloud vendors instead of major players requires carefully understanding the organizational risk appetite.
1. **Row and cell level database encryption tradeoffs** (27:14) — Advanced database encryption methods must be proportional to risk due to the complexity of underlying key management and incident recovery.
1. **Presentation design and open source markdown tools** (29:06) — Markdown-based HTML presentation formats allow for rapid pacing and easy open source technical content generation.
1. **Usability and syntax challenges with rego and opa** (30:11) — Complex policy languages heavily prioritize performance over developer readability and require strict testing structures for validation.
1. **Mitigating software supply chain vulnerabilities with speed** (32:53) — Treating patch deployments like regular feature releases maintains rapid delivery while lowering third-party software supply chain dependency risks.
1. **Bridging engineering constraints and public sector governance** (35:58) — Brokering risk conversations in public systems involves translating abstract technology risks into concrete business trade-offs.
1. **Evaluating proportional security isolation and sandbox tactics** (40:19) — No environment is completely secure, meaning isolation tactics like sandboxing only represent one end of the overarching cost and risk spectrum.
1. **Expanding on policy as code methodology concepts** (43:34) — Contributing to open source thought leadership helps challenge current industry paradigms around infrastructure management and versioning.

## Related Moments

- [Enforcing policy validations in continuous integration pipelines](https://www.wearedevelopers.com/videos/713-opa-for-the-cloud-natives) (from "OPA for the cloud natives")
- [Implementing programmatic policy checks with Open Policy Agent](https://www.wearedevelopers.com/videos/109-a-practical-guide-to-writing-secure-dockerfiles) (from "A practical guide to writing secure Dockerfiles")
- [Enforcing compliance with guardrails and policy as code](https://www.wearedevelopers.com/videos/1426-great-devex-and-regulatory-compliance-possible) (from "Great DevEx and Regulatory Compliance - Possible?")
- [Automating customized policy enforcement with open source tools](https://www.wearedevelopers.com/videos/495-what-we-learned-from-reading-100-kubernetes-post-mortems) (from "What we Learned from Reading 100+ Kubernetes Post-Mortems")
- [Balancing coding productivity with enterprise data governance pipelines](https://www.wearedevelopers.com/videos/100245-theia-ai-live-demo-air-gapped-ai-for-developer-tools-and-ides) (from "Theia AI Live Demo: Air Gapped AI for Developer Tools and IDEs")
- [Exploring advanced security tooling and community dependency vetting](https://www.wearedevelopers.com/videos/1041-reviewing-3rd-party-library-security-easily-using-openssf-scorecard) (from "Reviewing 3rd party library security easily using OpenSSF Scorecard")

## Related Articles

- [The Future of Open Source: A Deep Dive - Scott Chacon at WeAreDevelopers World Congress 2024](https://www.wearedevelopers.com/magazine/471-the-future-of-open-source-a-deep-dive-scott-chacon-at-wearedevelopers-world-congress-2024)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Now is the time for industrialized software development](https://www.wearedevelopers.com/magazine/601-now-is-the-time-for-industrialized-software-development)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)

## Related Jobs

- [Senior Software Engineer, Enterprise Products](https://www.wearedevelopers.com/jobs/ext/1841248-senior-software-engineer-enterprise-products) at **GitHub**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Staff Software Engineer](https://www.wearedevelopers.com/jobs/ext/1425755-staff-software-engineer) at **GitHub**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Tribe Lead - ( Software) Engineering Centre of Excllence](https://www.wearedevelopers.com/jobs/ext/1475530-tribe-lead-software-engineering-centre-of-excllence) at **SD Worx**