Definition
Policy-as-code is the practice of writing an organization’s security, cost, compliance and operational rules as version-controlled, machine-readable code - for example in OPA (Rego), HashiCorp Sentinel, or YAML/JSON - so they can be tested, reviewed and enforced automatically every time a change is proposed.
In short
Rules live in Git next to the infrastructure they govern, with history and review.
Evaluation is automatic and consistent: the same rule runs on every change.
Outcomes are explicit - allow, deny, or escalate to a human approver.
How it works
Express a requirement - “no public storage”, “prod changes need approval”, “monthly cost under budget” - in a policy language.
Commit policies to Git so changes are reviewed and auditable.
At plan, deploy, remediate and destroy, the proposed change is checked against applicable policies and context (environment, resource type, cost, tags).
The change is allowed, blocked, or escalated for human approval.
The decision, the policy matched and the rationale are logged.
Manual reviews do not scale with cloud infrastructure or with autonomous agents. When software agents can make changes, policy-as-code is what keeps autonomy safe: it defines exactly what an agent may do, where, and under whose approval.
OpenAna enforces policy-as-code before Ana takes any action - supporting OPA, Sentinel and native YAML/JSON, with environment-specific rules, cost ceilings, compliance frameworks (CIS, HIPAA, NIST, ISO 27001) and a full decision log.
FAQ
Common choices are Open Policy Agent’s Rego, HashiCorp Sentinel, and declarative YAML or JSON rule formats.
Related terms
Learn
The ADLC, or AI-Driven Development Lifecycle, is OpenAna’s methodology for how an autonomous AI engineer does work: plan, understand, clarify, implement, test, approve, audit and remember. Unlike a classic SDLC with blanket stage gates, it applies risk-aware approvals - speed where it is safe, human control where it is needed.
Learn
Autonomous remediation is the practice of software agents fixing problems - vulnerabilities, misconfigurations, failing deployments or production incidents - rather than only detecting and reporting them. The agent diagnoses the issue, writes the change (a code patch, dependency upgrade or infrastructure fix), validates it with tests, and routes it through the organization’s approval and deployment process.
Learn
AI vulnerability remediation uses AI agents to fix security vulnerabilities end to end: triaging findings by real exploitability, writing the patch or dependency upgrade, adding tests that prove the fix, and producing evidence for auditors. It closes the gap between how fast vulnerabilities are found and how fast teams can fix them.
See it in practice
Thirty minutes, your systems, one real problem.