Policy as Code
Policy as code is the practice of defining governance rules in versioned, machine-readable files rather than prose or scattered configuration, so policy can be reviewed, tested, signed, and applied consistently and automatically.
Definition
Policy as code is the practice of defining governance rules in versioned, machine-readable files rather than prose or scattered configuration, so policy can be reviewed, tested, signed, and applied consistently and automatically.
Treating policy like software
When rules live in a document or in ad-hoc if-statements across services, they drift, conflict, and resist audit. Policy as code moves them into versioned artifacts that go through the same lifecycle as application code: peer review on change, testing against expected decisions, and a clear history of who changed what and when. The result is governance you can reason about — a single source of truth that a decision engine evaluates the same way every time.
Signing, simulation, and shadow policy
Cordum stores policy as versioned bundles and adds production-grade safeguards. Bundles can be signed (an Ed25519 signature over the bundle digest), with a strict mode that rejects unsigned policy, so only reviewed-and-approved rules take effect. Operators can simulate a policy against historical traffic to see what it would have decided, and run a shadow policy alongside the active one to measure impact before promotion. This lets teams change governance confidently without guessing at the blast radius of a rule change.
Frequently asked questions
How is policy as code different from writing rules in application code?
Application-level if-statements are scattered, hard to audit, and re-implemented per service. Policy as code centralizes rules in versioned, testable artifacts that one decision engine evaluates uniformly, so behavior is consistent and changes are reviewable.
How do you safely change a policy in production?
Simulate the new policy against past traffic to preview its decisions, run it in shadow mode alongside the active policy to measure impact, and require signed bundles so only reviewed changes take effect before promotion.
Related reading
Govern your AI agents with Cordum
Cordum is the agent control plane: policy-before-dispatch enforcement, human approvals, and a tamper-evident audit trail for autonomous AI agents.