Policy as Code
Policy as code is writing governance, security, and compliance rules as machine-readable, version-controlled code so systems enforce them automatically instead of waiting on a human review. For agentic AI it's how you encode the guardrails: what an agent can access, what it can do, and what makes it stop.
Also known as: policy-as-code, PaC
The idea came out of cloud, and the original pitch was ambitious: encode your security and configuration rules as executable policy instead of static documents, build it right, and you’d never have another security problem. That didn’t survive contact with production. Teams still needed cloud compliance tooling and a second layer of controls on top, and policy as code settled into being one important element rather than the whole answer. Applied to agentic AI, it means writing down what an agent can access, which actions it can take, and what triggers a halt, so those limits run automatically instead of depending on someone catching a violation afterward.
Policy as code applies deterministic rules to systems that behave probabilistically and run work in parallel, while the rules humans write assume a linear, step-by-step process. Push determinism far enough and you’re arguably rebuilding RPA rather than deploying an autonomous agent. So policy as code needs a supporting stack: inventory every agent, evaluate it in a simulated environment before it touches production, generate and monitor the policies, keep audit and compliance reporting good enough to reconstruct what happened, and put humans in supervisory roles — “human on top” rather than human in the loop, since a checkpoint inside the loop imports a linear construct into a system that doesn’t run linearly.
