The Old Way: Governance by Document
Imagine a company's safety rules written in a binder that sits on a shelf. Everyone knows the binder exists. Nobody reads it. Governance in traditional IT worked the same way: a 50-page PDF titled "IT Security Standards v4.2" lived on SharePoint, and compliance was someone else's problem until something went wrong.
These documents said things like:
- "All repositories must have branch protection."
- "All S3 buckets must be encrypted."
- "All applications must have a README."
The Problem: Documents are ignored. To enforce these rules, companies hired "Gatekeepers" — Change Approval Boards (CABs) and Security Reviewers — to manually check compliance before every deployment. This process is slow, error-prone, inconsistent, and universally hated by developers. A CAB meeting that blocks a critical hotfix for 48 hours is not governance; it is friction with a badge.
The New Way: Governance as Code
Governance as Code (GaC) shifts policies from human-readable documents into machine-executable code. Instead of writing a rule in English ("You must require code reviews"), you express it in a tool like Terraform, Open Policy Agent (OPA), or a CI pipeline step.
- If infrastructure violates the rule, the deployment fails automatically — no human reviewer needed.
- If a live system drifts from the rule, the platform detects and corrects it automatically.
You are not just documenting the rules; you are codifying them into the platform itself. The policy becomes a test. The test runs on every change. Compliance is continuous, not periodic.
The key insight is that Governance as Code separates policy definition (what the rule is) from policy enforcement (checking that the rule is followed). Both are now automated, auditable, and version-controlled — just like application code.