Policy-as-Code

Policy-as-code means expressing governance rules in a machine-readable form that can be version-controlled, reviewed, tested and enforced automatically — rather than in a document that describes what people are supposed to do. The policy becomes an artefact in the same system as the software it governs: it has an author, a history, a diff, and a rollback.

The distinction that matters in practice is between a policy that is written and a policy that is enforced. Most AI governance programmes have the first. A written policy is evidence of intent; an enforced policy is evidence of control, and the two are not interchangeable to an examiner who asks what actually stopped the request.

How it differs from a policy document. A document is read by people and applied by judgement. Policy-as-code is applied by a system on every request, identically, whether or not anyone is watching. The document explains why; the code decides.

How it differs from infrastructure-as-code. Infrastructure-as-code declares what should exist. Policy-as-code declares what is permitted at runtime, evaluated per request against the identity and content of that request. They share the review workflow and solve different problems.

Where it meets the CISO. Policy-as-code is the artefact both a platform team and a risk function can read. The platform team gets something testable; the risk function gets something auditable with a change history. That shared object is usually where AI governance stops being a negotiation.

Maestro is Smartflow's policy engine, with versioning and rollback.

Maestro