# policy-as-code Published articles for policy-as-code. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next DevFeed: [Policy as Code in 2026: OPA, Kyverno, Cedar and What's Next]() Original publisher: [Read original article]() Author: Abhijit Pujare Eric Minick Published: 2026-09-11T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [policy-as-code](), [Open Policy Agent](), [rego](), [Kyverno](), [Software Engineering](), [Kubernetes](), [JSON](), [YAML](), [AI Agent]() Tags: [ai-agent](), [compliance](), [json](), [kyverno](), [opa](), [open-policy-agent](), [policies](), [policy-as-code](), [rego](), [security](), [software-engineering](), [yaml]() ### AI overview This article surveys the 2026 Policy as Code ecosystem, comparing general-purpose Open Policy Agent and Rego with specialized approaches such as Kyverno, Cedar, and agent-oriented governance. It discusses the shift toward automated, machine-readable governance, the separation of policy from business logic, and the challenges of authoring and maintaining Rego as schemas evolve. ### Source excerpt | Blog ## Beyond the Merge: Enforcing Policy Before the Terraform Apply DevFeed: [Beyond the Merge: Enforcing Policy Before the Terraform Apply]() Original publisher: [Read original article]() Author: Sachin Agarwal Published: 2026-09-03T17:25:32Z Content type: article Language: en Sources: [Nirmata]() Topics: [iac-security](), [Terraform](), [Security](), [Kyverno](), [Tooling]() Tags: [ci](), [cloud-security](), [code-security](), [infrastructure-as-code](), [kyverno](), [other](), [policy-as-code](), [pull-request](), [scanner](), [security](), [shift-left](), [terraform]() ### AI overview The article describes using Nirmata Control and its nctl CLI to evaluate Terraform plans against policy-as-code rules before deployment. It presents pre-apply CI checks for detecting infrastructure misconfigurations, including unrestricted ingress, missing S3 public-access blocking, wildcard IAM resources, and missing VPC deployment. ### Source excerpt Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource. ## DevOps vs Platform Engineering & Software Platforms DevFeed: [DevOps vs Platform Engineering & Software Platforms]() Original publisher: [Read original article]() Author: Eric Minick Published: 2026-08-11T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [DevOps](), [Platform Engineering](), [Software Engineering](), [CI/CD](), [Infrastructure as code](), [Monitoring](), [Artificial Intelligence]() Tags: [ai](), [ci-cd](), [devops](), [infrastructure-as-code](), [monitoring](), [platform-engineering](), [policy-as-code](), [self-service](), [software-engineering]() ### AI overview This article explains how DevOps and platform engineering address different parts of software delivery. It describes DevOps as a culture and set of practices, while platform engineering provides internal tooling and self-service infrastructure to make those practices repeatable at scale. It also discusses when platform engineering becomes useful, how software engineering platforms combine both approaches, and why AI increases the need for governed self-service and policy-as-code. ### Source excerpt DevOps vs platform engineering: what is the difference? Learn how they relate, when to use each, and how a software engineering platform combines both. | Blog ## Critical Kyverno Vulnerability -- CVE-2026-54523 DevFeed: [Critical Kyverno Vulnerability -- CVE-2026-54523]() Original publisher: [Read original article]() Author: Anubhav Sharma Published: 2026-07-29T01:08:41Z Content type: news Language: en Sources: [Nirmata]() Topics: [Kyverno](), [vulnerability](), [Exploit](), [Kubernetes](), [Cloud Native Ecosystem]() Tags: [2026](), [admission-controller](), [ai](), [cloud-native](), [cloud-native-ecosystem](), [cncf](), [cve](), [devsecops](), [engineering](), [kubernetes](), [kyverno](), [nctl-ai](), [platform-engineering](), [policy](), [policy-as-code](), [policy-management](), [release](), [upgrade](), [vulnerability]() ### AI overview The article reports CVE-2026-54523, a critical Kyverno vulnerability affecting versions 1.18.0 and 1.18.1. A tenant able to create a NamespacedMutatingPolicy could bypass namespace isolation and generate resources in other namespaces, potentially enabling cluster-wide privilege escalation. Kyverno 1.18.2 patches the vulnerability. ### Source excerpt Critical Kyverno Vulnerability -- CVE-2026-54523 On July 13, 2026, a critical vulnerability was disclosed in Kyverno, the Kubernetes-native policy engine used broadly across the cloud native ecosystem for policy-as-code enforcement. The vulnerability, tracked as CVE-2026-54523 (GHSA-79gf-7frw-68m9), allows a tenant with permission to create a NamespacedMutatingPolicy... The post Critical Kyverno Vulnerability -- CVE-2026-54523 first appeared on Nirmata. ## A Step-by-Step Guide to Feature Flag Implementation in CI/CD DevFeed: [A Step-by-Step Guide to Feature Flag Implementation in CI/CD]() Original publisher: [Read original article]() Author: Aaron Newcomb Published: 2026-07-23T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [CI/CD](), [feature flags](), [GitOps](), [Automation](), [Microservices](), [Deployment]() Tags: [automation](), [ci-cd](), [deployment](), [feature-flags](), [gitops](), [governance](), [guide](), [microservices](), [pipelines](), [policy-as-code](), [rollback]() ### AI overview A step-by-step tutorial on implementing feature flags in enterprise CI/CD pipelines. It explains how governance, policy as code, GitOps workflows, automation, verification, gradual rollouts, and rollback capabilities can help teams manage releases across many services while maintaining control and compliance. ### Source excerpt Discover how to implement Feature Flags in CI/CD pipelines using governance, automation, and AI-driven delivery. Speed up your releases while keeping them safe. | Blog ## Automated DevOps Compliance with Harness Rego Policy Packs DevFeed: [Automated DevOps Compliance with Harness Rego Policy Packs]() Original publisher: [Read original article]() Author: Abhijit Pujare Vishal Vishwaroop Published: 2026-07-14T00:00:00Z Content type: release Language: en Sources: [Harness Blog]() Topics: [DevOps](), [rego](), [sdlc](), [opa](), [Security]() Tags: [audit](), [compliance](), [devops](), [governance](), [opa](), [policy](), [policy-as-code](), [rego](), [sdlc]() ### AI overview Harness announces Policy Packs, a curated library of pre-written Rego policies that helps teams align software delivery lifecycles with compliance frameworks. The packs provide out-of-the-box governance controls covering frameworks including SOC 2, NIST, PCI DSS, HIPAA, and HITRUST. ### Source excerpt Shift governance left with out-of-the-box Policy-as-Code. Simplify compliance and achieve continuous audit readiness across your entire SDLC. | Blog ## Pulumi ships a 238-policy ISO/IEC 27001:2022 pack for AWS DevFeed: [Pulumi ships a 238-policy ISO/IEC 27001:2022 pack for AWS]() Original publisher: [Read original article]() Author: Dan Biwer Published: 2026-06-30T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Amazon Web Services](), [Security](), [Cloud](), [configuration]() Tags: [audit](), [aws](), [compliance](), [crossguard](), [features](), [governance](), [infrastructure](), [iso](), [iso-27001](), [policy](), [policy-as-code](), [product](), [pulumi](), [pulumi-cloud](), [security](), [standard]() ### AI overview Pulumi announces a pre-built ISO/IEC 27001:2022 policy pack for AWS, available in Pulumi Cloud as iso-27001-aws. The pack contains 238 policies mapped to relevant ISO 27001 controls and supports auditing existing AWS resources and preventing non-compliant resources during pulumi up. ### Source excerpt ISO/IEC 27001 is the international standard for information security management. Proving you meet it usually means months of mapping abstract security controls to concrete cloud configuration, then authoring custom checks one resource at a time. We're changing that. Today we're shipping a pre-built ISO/IEC 27001:2022 policy pack for AWS, live now in Pulumi Cloud as iso-27001-aws. It encodes the standard's security expectations as 238 ready-to-run policies, so you can align your AWS estate to ISO 27001 in minutes, not months. Why ISO 27001 matters For many companies, ISO 27001 is what stands between them and a customer or a market. The sooner you can reach a certifiable state and prove you stay there, the less compliance slows the business down. The pack collapses months of policy work into something you run continuously, so security keeps pace with growth instead of blocking it. How the pack maps to ISO 27001 The hard part of ISO 27001 has always been translation: its controls are written in the language of governance and risk management, not in the language of AWS resources. Every team has had to interpret each control and decide what it means for an S3 bucket or an RDS instance. The pack does that interpretation for you. Its 238 policies are aligned to the relevant ISO 27001 controls, so each result connects back to the standard instead of leaving you to map it yourself. You can browse the full pack in the pack reference. Audit and prevent The same pack works two ways, so you can both reach compliance and stay there: Audit. Scan your existing AWS estate against the pack, including resources that Pulumi doesn't manage. You get an honest baseline of where you stand against ISO 27001 today, with every finding tied back to the control it affects. Prevent. Run the same pack as a preventative policy during pulumi up to block non-compliant resources before they're ever created. New infrastructure is born aligned to the standard. Audit gets you clean. Preventative policie ## KubeCon Europe 2025: Why Identity is the New Backbone of Secure Infrastructure DevFeed: [KubeCon Europe 2025: Why Identity is the New Backbone of Secure Infrastructure]() Original publisher: [Read original article]() Author: david.sudia@goteleport.com (Dave Sudia) Published: 2025-04-22T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [Security](), [Cloud](), [Platform Engineering](), [supply-chain-security](), [AI Infrastructure](), [policy-as-code](), [WebAssembly](), [sigstore]() Tags: [2025](), [ai-infrastructure](), [cloud](), [cloud-native](), [kubecon](), [kubecon-eu](), [platform-engineering](), [policy-as-code](), [security](), [sigstore](), [software-supply-chain-security](), [webassembly]() ### AI overview An opinion article from KubeCon Europe 2025 argues that identity is central to securing cloud-native infrastructure. It connects platform engineering, AI workloads, software supply chain security, and WebAssembly with the need for short-lived, auditable identities and verified access for human and non-human actors. ### Source excerpt At KubeCon EU 2025, identity emerged as the key to cloud-native security. Learn why teams are shifting to short-lived, auditable identities--and how Teleport leads. ## Centrally enforce policy as code for GraphQL APIs DevFeed: [Centrally enforce policy as code for GraphQL APIs]() Original publisher: [Read original article]() Author: Vivek Ravishankar Published: 2023-12-12T14:00:00Z Content type: article Language: en Sources: [Apollo Blog]() Topics: [GraphQL](), [policy-as-code](), [Authorization](), [GraphOS](), [API Platform](), [Open Policy Agent]() Tags: [announcement](), [api-platform](), [authorization](), [developer](), [developers](), [graphos](), [graphql](), [opa](), [policy-as-code]() ### AI overview Apollo describes using GraphOS schema directives to enforce policy-as-code authorization at the type and field levels of federated GraphQL supergraphs. The directives are generally available to GraphOS Enterprise customers and can integrate with authorization systems such as Open Policy Agent. ### Source excerpt Although many in the industry consider GraphQL a replacement for existing API technologies, it is at its most powerful when used as a central orchestration layer between apps and existing services. This layer, implemented as a federated graph (or supergraph, for short), acts as a self-service API platform that accelerates development velocity for both frontend and backend teams.