Comparison
Policy as codevsShift left
Policy as code
the rule that every workload must set resource limits is a file with tests, and it fails the pipeline rather than a review.
Expressing organisational rules as executable, versioned, testable code evaluated automatically. It converts standards from documents people are supposed to have read into checks that run, and it makes exceptions explicit and reviewable rather than tacit. Rolling it out in report-only mode first is essential, because a policy applied to an existing estate always turns out to have more violations than anyone predicted.
Full entry →Shift left
the security review happened while the design was still a document instead of the week before launch.
Moving a check earlier in the process, where fixing what it finds is cheap. It applies to testing, security, accessibility, performance and compliance, and the economics are the same in each case: the cost of a change rises with how much has been built on top of it. It becomes a slogan rather than a practice when the earlier check is added without removing the later one or giving the team the ability to act on it.
Full entry →