SECAI Core · phase 8 of 15 · noun

Policy as code

The policy is defined, enforced, and managed using programming code rather than manual procedures

The Explain card

Plain English
Policy as code means rules are written, enforced and managed as program code rather than as manual procedures. The policy runs automatically wherever it is deployed.
Example
An organisation encodes "no model may be deployed without a completed risk assessment and an approved data source" as a rule in its CI/CD pipeline. A deployment missing either artefact fails the build, and the failure is logged as evidence.
Why it matters
Manual policy relies on people remembering. Code enforces the rule every time, produces an audit trail, and can be version-controlled and tested like any other software.
Hook
The rulebook that refuses to merge.

Word knowledge

How the word is built, where it came from, and what it sits beside in memory.

In a sentence

At Kubernetes admission, Gatekeeper runs policy as code and rejects a GPU pod whose container image is not from the approved registry.

Why these words
  • policy Middle French policie, from Late Latin politia, Greek politeia, citizenship names the organisational rules the phrase recasts as a file
  • as Old English as, a reduced form of alswa, even so the equative hinge, so the first noun is recast in the form of the second
  • code Latin codex, a book of laws, earlier caudex, a tree trunk names the form those rules take, source in a repo rather than a handbook
Where it came from
Origin
English DevOps collocation, modelled on infrastructure as code, from Middle French policie (Late Latin politia, Greek politeia) and Latin codex, a book of laws
Entered the language
2010s
What changed
Policy had meant a polity, then a course of action a government or firm adopts. Code had meant a bound book of laws, then a cipher, then the instructions a machine runs. After infrastructure as code treated machines as files in a repo, the same hinge was hung on written rules, so a policy could live next to Terraform and fire at plan time.
How it is spelled
Pattern
y from Latin -ia via French, as in colony and felony
Pattern
c before o is /k/ in code, as in copy
Pattern
the three words stay open, with hyphens only when the stack modifies another noun
Breaks the pattern
policy is a homograph: the insurance sense comes from Italian polizza, a written proof, not from Greek politeia
Breaks the pattern
code here is the computing sense, not the legal digest, though both come from Latin codex

Spelled like

  • police
  • politics
  • decode
  • encode
Broken into chunks
  • poli
    • politics
    • police
    • polity
  • cy
    • privacy
    • piracy
    • legacy
  • code
    • decode
    • encode
    • codebook
What it sits beside

Same subject

Same shape

As-code constructions

Governance documents

Where it sits in the deck

Phase 8: Governance, Risk, and Compliance Frameworks

Individual controls need a governance envelope — introduce the risk and compliance structures, standards bodies, and regulations that frame AI accountability at scale.

Neighbours in this phase