# Policy as Code

> A mechanism that expresses policies as machine-readable rules which a pipeline or policy engine evaluates automatically.

Record: `architecture:policy-as-code`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: recommended
Scope: infrastructure, deployment, security
Canonical: https://banes-lab.com/ontology#architecture-policy-as-code

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Policy Enforcement](https://banes-lab.com/records/architecture/policy-enforcement.md) and before [Risk Management](https://banes-lab.com/records/architecture/risk-management.md).

## Repair

- Refactored by: Encode Policy, Add CI Gate
- Detected by: missing policy rule for known control
- Violated by: manual policy checks not represented in code
- Measured by: automated policy coverage
- Enforced by: [policy engine](https://banes-lab.com/records/lexicon/policy-engine.md)

## Requires

- [Machine-Readable Policies](https://banes-lab.com/records/lexicon/machine-readable-policies.md)

## Reinforces

- [Continuous Compliance](https://banes-lab.com/records/architecture/continuous-compliance.md)

## Enables

- [Automated Enforcement](https://banes-lab.com/records/lexicon/automated-enforcement.md)

## Conflicts with

- [Manual-Only Governance](https://banes-lab.com/records/architecture/manual-only-governance.md)

## In tension with

- [Policy Maintenance](https://banes-lab.com/records/lexicon/policy-maintenance.md)

## Tensions

- [Policy as Code / Policy Maintenance](https://banes-lab.com/records/tension/policy-as-code-policy-maintenance.md)

## Severity

- [recommended](https://banes-lab.com/records/vocabulary/severity-recommended.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Enforced by

- [rules/eslint/closure-no-disable-comments.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/closure-no-disable-comments.eslint.rule.ts.md)
- [rules/eslint/closure-rule-shape.eslint.rule.ts](https://banes-lab.com/source/governance/rules/eslint/closure-rule-shape.eslint.rule.ts.md)

## Linked from

- [Writing constraints](https://banes-lab.com/pag/guide/writing-constraints.md)
- [Three encodings](https://banes-lab.com/disciplined-methodology/start/three-encodings.md)
- [Where a rule lives](https://banes-lab.com/disciplined-methodology/start/from-chat-to-tree.md)
- [From intent to predicate](https://banes-lab.com/software-architecture/coverage/an-architecture-is-its-predicate-set.md)
- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Portability / Infrastructure / Deployment](https://banes-lab.com/ontology/principles/architecture-category-portability-infrastructure-deployment.md)
- [Observability / Auditability / Traceability](https://banes-lab.com/ontology/principles/architecture-category-observability-auditability-traceability.md)
- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Core Vocabulary](https://banes-lab.com/ontology/lexicon/lexicon-category-core-vocabulary.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)