Policy as [versioned] code - you're doing it wrong

Is your 'policy as code' just creating new friction? Learn how treating policy like a versioned software dependency finally makes compliance a collaborative engineering task.

#1about 7 minutes

Introducing the key personas in policy management

An allegorical story illustrates the conflicting perspectives of a CIO, product manager, developer, and operations staff on policy.

#2about 4 minutes

Why simply codifying policy is not enough

Codified policies often fail due to being kept secret, causing breaking changes during deployment, and generating warnings that are ignored in CI/CD pipelines.

#3about 5 minutes

Applying software patterns to policy management

The solution is to treat policy like a software dependency by making it visible, applying semantic versioning, and including tests.

#4about 4 minutes

Implementing versioned policy with modern tooling

A demonstration shows how to manage versioned policies for Terraform and Kubernetes using tools like Checkov, Kyverno, and Renovate for automated updates.

#5about 3 minutes

The cultural importance of purpose-driven policy

Effective policy requires a clear narrative explaining the risk it mitigates, which encourages collaboration and allows the policy to evolve with the business.

#6about 22 minutes