What is Policy as Code (PaC)

What is policy as code?

Policy as code (PaC) is the practice of writing security, compliance and infrastructure policies as code so that systems can enforce, test and audit them automatically. Instead of a rule living in a document that someone has to read and apply, the rule lives in a file that a policy engine applies the same way every time.

How policy as code works

Policies written as code integrate directly with IT infrastructure management, so enforcement, validation and auditing of policies happen automatically. With PaC, organizations can hold every environment to the same standards and regulations without a manual review step. 

PaC replaces manual review and enforcement with automated, systematic policy application. That reduces human error, strengthens security compliance and gives IT a record of what each policy said and when it was applied. 

Policy as code languages

Policy as code is only as good as the language it's written in. These three matter most today, and they solve different problems: 

Cedar

Cedar is an open-source, declarative authorization language and evaluation engine. Policies define principals, actions, resources and context, and then engine returns an allow or deny decision in milliseconds. It supports role-based and attribute-based models, with relationship-based patterns built on top. Formal verification means a policy's effects can be proven rather than just tested. Cedar is also a Cloud Native Computing Foundation (CNCF) project adopted by Cloudfare, MongoDB and AWS. 

Best for: fast, fine-grained decisions on individual requests, where teams need to know exactly what a policy allows. 

Open Policy Agent (OPA) and Rego

OPA is a CNCF graduated project and the most widely deployed general-purpose policy engine. Its language, Rego, evaluates structured data (JSON, YAML, API payloads) against rules, so one engine can gate Kubernetes admission, evaluate Terraform plans in CI, authorize an API call or check a config file. OPA comes with a steeper learning curve than Cedar without the same formal guarantees. 

Best for: a single policy engine across many inputs and enforcement points.

OpenFGA

Open FGA is a CNCF project that implements relationship-based authorization, modeled on the system Google built for Docs and Drive. It uses a modeling language rather than a standalone policy language, but it answers a question the other two struggle with: who can reach a specific object, and through what chain of relationships. 

Best for: permissions that follow a graph, such as document owners, nested folders or team hierarchies. 

How to implement policy as code

Moving to a PaC model requires a structured approach:

1. Define policies. Understand what each policy requires and tie it to the business goal or regulation it serves.
2. Choose tools. Pick the engine that fits your needs, considering factors such as environment capabilities and ease of use.
3. Write the policies as code. Use syntax and structures provided by your selected tools. Start from community examples and adapt them rather than writing from scratch.
4. Test the policies. Run policies in a controlled setting to make sure they perform as expected and don't disrupt operations.
5. Deploy and monitor. Roll policies out across environments, watch for violations and refine rules as systems change.

Policy as code examples

• Security policy as code: Organizations use PaC to automate enforcement of security standards such as least privilege, network segmentation and data encryption reducing the attack surface and strengthening data security.
• Infrastructure compliance: Companies check that all infrastructure deployments comply with organizational policies and industry standards, avoiding costly compliance violations. 
• Cloud configuration management: Using tools like AWS Config rules, businesses automate the management of cloud resource configurations so they consistently meet compliance and security standards. 

More resources

Blogs

How Policy-based Access Control Improves Agility and Security

StrongDM Brings Continuous Authorization to the Delinea Platform

The Access Control Paradigm: Unpacking ABAC, PBAC & RBAC