![Policy as [versioned] code - you're doing it wrong](https://customer-goifxnzhrq3d0d54.cloudflarestream.com/23fa4a514c18f0a9b39573f31d96ba54/thumbnails/thumbnail.jpg?time=33000ms){kind=small}
An allegorical story illustrates the conflicting perspectives of a CIO, product manager, developer, and operations staff on policy.
Codified policies often fail due to being kept secret, causing breaking changes during deployment, and generating warnings that are ignored in CI/CD pipelines.
The solution is to treat policy like a software dependency by making it visible, applying semantic versioning, and including tests.
A demonstration shows how to manage versioned policies for Terraform and Kubernetes using tools like Checkov, Kyverno, and Renovate for automated updates.
Effective policy requires a clear narrative explaining the risk it mitigates, which encourages collaboration and allows the policy to evolve with the business.
The speaker answers audience questions about cultural challenges, tooling like OPA, supply chain attacks, and the role of risk management.
58:40Christian Strack
46:37Chris Riley
43:00Luka Kladaric
56:19Pawel Piwosz
37:46Sonal Patil
50:23Andrew Holway
30:46Josh Armitage
1:00:00Alex Olivier
Jobs that call for the skills explored in this talk.
Reflow
Zürich, Switzerland
Reflow
Amsterdam, Netherlands
