WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE β€’ Oct 19, 2022

Policy as [versioned] code - you're doing it wrong

Chris Nesbitt-Smith

Writing rules in YAML isn't true policy as code. Stop breaking CI pipelines and start treating compliance as a visible, version-controlled software dependency.

Pause
Mute Enter Fullscreen
#1 about 5 min

Elevator pitch analogy for policy management

A fictional elevator scenario illustrates the pain points of policy enforcement among executives, product managers, and developers.

#2 about 4 min

Core promises of policy as versioned code

Treating policy as a versioned dependency enables faster updates, local compliance checks, and clear communication.

#3 about 4 min

Common pitfalls in implementing policy as code

Hiding security policies from developers leads to reverse-engineered constraints, broken deployments, and brittle case law exemptions.

#4 about 5 min

Managing policies exactly like standard software dependencies

Making policy source code visible and applying semantic versioning allows automatic compliance updates via standard continuous integration tools.

#5 about 5 min

Code demonstration using terraform and kubernetes

Evaluating semantic policy versions systematically across environments relies on localized validation and active admission controllers.

#6 about 4 min

Connecting policy rules directly to business risk

Policies must carry a clear risk narrative to prevent agile product teams from treating them as unnecessary friction.

#7 about 2 min

Addressing cultural resistance to compliance policy controls

Tangible risk communication prevents teams from viewing essential policies as bureaucratic hurdles.

#8 about 2 min

Evaluating risk scenarios across cheaper cloud providers

Using smaller cloud vendors instead of major players requires carefully understanding the organizational risk appetite.

#9 about 2 min

Row and cell level database encryption tradeoffs

Advanced database encryption methods must be proportional to risk due to the complexity of underlying key management and incident recovery.

#10 about 2 min

Presentation design and open source markdown tools

Markdown-based HTML presentation formats allow for rapid pacing and easy open source technical content generation.

#11 about 3 min

Usability and syntax challenges with rego and opa

Complex policy languages heavily prioritize performance over developer readability and require strict testing structures for validation.

#12 about 4 min

Mitigating software supply chain vulnerabilities with speed

Treating patch deployments like regular feature releases maintains rapid delivery while lowering third-party software supply chain dependency risks.

#13 about 5 min

Bridging engineering constraints and public sector governance

Brokering risk conversations in public systems involves translating abstract technology risks into concrete business trade-offs.

#14 about 4 min

Evaluating proportional security isolation and sandbox tactics

No environment is completely secure, meaning isolation tactics like sandboxing only represent one end of the overarching cost and risk spectrum.

#15 about 3 min

Expanding on policy as code methodology concepts

Contributing to open source thought leadership helps challenge current industry paradigms around infrastructure management and versioning.

Matching moments

1:22 min

Enforcing policy validations in continuous integration pipelines

Philipp Krenn Β· World Congress 2023

7:07 min

Implementing programmatic policy checks with Open Policy Agent

Madhu Akula Β· LIVE

2:31 min

Enforcing compliance with guardrails and policy as code

Martin Reynolds Martin Reynolds Β· World Congress 2025

4:48 min

Automating customized policy enforcement with open source tools

Noaa Barki Β· World Congress 2022

3:01 min

Balancing coding productivity with enterprise data governance pipelines

Thomas Froment Thomas Froment Β· World Congress 2026 Europe

3:58 min

Exploring advanced security tooling and community dependency vetting

Niels Tanis Niels Tanis Β· World Congress 2024

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
10 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
17 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof CieΕ›lak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
18 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
24 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
25 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
about 1 month ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Related videos

OPA for the cloud natives thumbnail
26:23
World Congress 2023 β€’ almost 3 years ago

OPA for the cloud natives

Philipp Krenn

Decoupled Authorization using Policy as Code thumbnail
32:16
LIVE β€’ almost 6 years ago

Decoupled Authorization using Policy as Code

Anderson Dadario, Denys Vitali

One Pipeline, Three Regulator - SBOM Compliance for the Developer thumbnail
28:29
World Congress 2026 Europe β€’ 3 months ago

One Pipeline, Three Regulator - SBOM Compliance for the Developer

Marcus Ross

Great DevEx and Regulatory Compliance - Possible? thumbnail
23:26
World Congress 2025 β€’ about 1 year ago

Great DevEx and Regulatory Compliance - Possible?

Martin Reynolds

Un-complicate authorization maintenance thumbnail
1:00:00
LIVE β€’ over 2 years ago

Un-complicate authorization maintenance

Alex Olivier

DevSecOps culture thumbnail
16:00
World Congress 2023 β€’ almost 3 years ago

DevSecOps culture

Ali Yazdani

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.