devopsy.kinsta.cloud

Author: Ritesh Patel

Will Policy-as-Code Still Matter if AI Generates Most Code?

As artificial intelligence (AI) code-generation tools like GitHub Copilot and ChatGPT revolutionize software development, a critical question emerges: If AI writes most code, do we still need policy-as-code (PaC) to govern it? The answer isn’t just ‘“yes’” — it is a resounding ‘“now more than ever’.” To understand why, we must explore PaC’s evolution, its role in modern infrastructure and how it will anchor trust in the AI-driven future.

What is Policy as Code? A Governance Layer Born From Chaos

PaC is the practice of defining security, compliance and operational rules in machine-readable formats, enabling automated enforcement across systems. It emerged in the shadow of infrastructure as code (IaC), which allowed teams to programmatically manage servers, networks and cloud resources. However, as IaC scaled, manual policy checks became untenable.

Imagine deploying 100 cloud instances via IaC, only to realize half violate cost or security rules. PaC solved this by codifying policies (e.g., “no public S3 buckets”) directly into pipelines, blocking non-compliant resources before deployment. Tools like Kyverno and Open Policy Agent became the enforcement backbone for DevOps and platform teams.

Why is Policy-as-Code Having its Moment?

The transition to declarative systems such as Kubernetes, Terraform and serverless architectures introduced a powerful new paradigm — one where engineers specify the desired end state rather than the implementation details. While this abstraction accelerates development, it also introduces governance challenges. PaC has emerged to bridge these gaps by embedding policy enforcement directly into the software life cycle.

PaC offers key advantages: Flexibility to adapt policies across diverse environments — cloud, on-premises and hybrid — without rewriting workflows; transparency through human-readable code that fosters collaboration among developers, security teams and compliance officers; automation at scale, enabling real-time enforcement across complex infrastructures like Kubernetes clusters and continuous integration and continuous deployment (CI/CD) pipelines; and seamless integration with modern development workflows, allowing policies to provide immediate feedback and shift enforcement left in the development process.

Together, these capabilities make PaC an essential pillar in governing modern, declarative systems.

The Future of Policy as Code in the Age of AI

The Premji Invest blog, “AI Is Coming: Meet the Startups Building Cyber Defenses for the Age of AI,” highlights the unprecedented risks introduced by AI, ranging from data leakage in training pipelines and adversarial attacks on models to regulatory ambiguity. In response, startups are increasingly integrating PaC into AI workflows. However, PaC’s role is rapidly evolving in light of three seismic shifts.

First, the rise of Agentic AI — autonomous agents capable of managing infrastructure or making decisions — demands runtime policy enforcement. PaC provides a critical framework for governing these agents, defining clear boundaries around what data they can access, what actions they can perform and when human approvals are needed for high-impact operations.

Second, as AI models dynamically adapt to new data, a model context protocol (MCP) becomes essential. By integrating PaC with MCP, organizations can ensure AI models operate within contextual boundaries, preventing unauthorized access to sensitive data and enforcing compliance with regulatory constraints (e.g., blocking a medical AI from inferring patient identities).

Third, the emergence of agent-to-agent (A2A) ecosystems — where multiple AI systems collaborate across domains, such as supply chain management — necessitates cross-system policy harmonization. PaC can codify authentication standards, interaction limits and data sharing rules, maintaining organizational control even as agent interactions grow more complex.

In this rapidly shifting landscape, PaC is no longer just a static set of rules — it is becoming a set of adaptive guardrails for governing AI behavior, managing data flows and upholding ethical boundaries.

Will Policy as Code Still Matter if AI Generates Most Code? Yes, Here’s Why

AI is transforming software development, but its integration into workflows is not without risks. While AI-generated code can speed up development, it may also introduce vulnerabilities, like insecure application programming interface (API) endpoints, or overlook critical compliance requirements, such as the General Data Protection Regulation (GDPR) data residency rules. PaC acts as a crucial safety net, scanning AI-generated code for risks and automatically rejecting violations.

Beyond technical issues, policies also reflect human values such as privacy, fairness and legality. While AI may produce efficient solutions, it should not be left to decide which data to collect or how to weigh profit against ethical considerations. PaC encodes these human-centric judgments, aligning AI outputs with organizational principles.

As demands for transparency grow, driven by regulations like the European Commission’s EU AI Act, PaC offers explicit, auditable rules, providing clarity where AI-driven decision-making might resemble a black box. When it comes to accountability, “show me the policy” is more reliable than “trust the AI.” Additionally, as AI continues to evolve, so too will the threats against it will evolve as well. PaC provides a programmable, adaptable defense layer that can keep pace with emerging vulnerabilities, including those that originate in AI-generated code.

Ultimately, the future is not about choosing between PaC and AI — it is about leveraging their synergy. Imagine a workflow where AI drafts policy templates based on regulatory changes, humans refine them to include ethical and strategic nuances, PaC tools enforce them across systems and feedback loops help AI improve policy design. This cycle unites AI’s speed with human judgment and PaC’s rigor, creating a more secure and ethically aligned AI ecosystem.

Policy as Code is the Bedrock of AI Trust

As AI reshapes software development, PaC won’t just survive — it will thrive. It bridges the gap between innovation and governance, ensuring AI serves humans, not the reverse. Whether guarding Kubernetes clusters or GPT-4 workflows, PaC is the immutable layer that makes automation responsible.

In the age of AI, writing code is no longer a human monopoly. However, defining what that code should do— and what it must never do— will always be up to us. PaC is how we will keep it that way.

The call to action for organizations is to start embedding PaC into your AI workflows today. Tools like Kyverno (for Kubernetes) and emerging AI-focused platforms are your first line of defense in the automated future.

May 14, 2025
Protecting CI/CD Pipelines to Secure the Software Supply Chain

Cloud-native applications have become increasingly complex. Composed of an infrastructure stack of mash-up code, hundreds of open source and commercial components, services and APIs, today’s software supply chain is fraught with security risks. At the same time, the ability to manage existing application requirements while building innovation and taking on new areas of responsibility like security is stretching DevOps teams beyond their capacity. The concern for the number of connected and exploitable weaknesses across the software supply chain are now requiring organizations to take a proactive approach to protect their continuous integration and continuous delivery (CI/CD) systems, as they have become a target through which attackers infiltrate multiple production systems. But meeting this requirement is no easy feat as it often requires organizations to choose between how much security to enforce in the build cycle while quantifying their risk to build and deploy quickly.

A recent survey revealed that nearly all (97%) of an organization’s assets—and security issues—are now in the cloud. And yet, only 29% of an organization’s assets are associated with cloud-specific policies. Addressing this gap requires organizations to have a proactive approach to protect their technology infrastructure, especially securing the artery of their software supply chain: The CI/CD pipeline. By embracing new security and compliance strategies within their governance approach, organizations can better protect their CI/CD pipeline and cloud applications.

There is a growing shift toward programmable infrastructure and infrastructure-as-code (IaC) practices to build out infrastructure and manage configuration files. But with this practice comes the increased risk of exposing application credentials, API keys, encryption keys and digital certificates. Tools supporting the CI/CD pipeline have now become the artery of cloud applications, and it’s becoming more challenging to store, transmit and audit data securely. In addition, when CI/CD tools interact with other systems in the DevOps environment, it increases the risk of exposure for configuration files. A compromise in the build system, for example, can be used to get access to production systems that can result in the exposure of sensitive information or the injection of malicious code, corrupting the entire CI/CD pipeline and thus the software supply chain.

A recent Unit 42 Cloud Threat report revealed that overly permissive credentials created added risk opportunities in the CI/CD pipeline. The study found that 63% of IaC templates contained misconfigurations and 91% of container images contained high or critical security vulnerabilities. To address this, organizations need to catch security problems in the build process before cloud workloads are provisioned. During the SolarWinds compromise, for instance, attackers used custom malware designed for the company’s build cycle to observe each step. The sophistication of the intrusion in this attack during the software build process is a key lesson for DevOps and DevSecOps professionals and revealed how security needs to be approached.

One way to address this is by being able to identify CI pipeline misconfigurations, which can improve security in the software supply chain. Because CI pipelines are configured in the code, the same policy-as-code approach can be used to identify IaC misconfigurations or open source vulnerabilities to surface CI/CD weaknesses. DevOps and developer teams can keep configurations accessible to just a small group who are building for production release. By establishing enforceable permissions to the pipeline, there is better control over who can commit code changes to the repositories, create containers and deploy code to different environments.

Strong chains of trust throughout the build cycle are not commonplace today. But as organizations look at ways to strengthen their risk posture by shifting left, security and DevOps teams can work toward proactively hardening pipelines with the right CI/CD tools and frameworks and push the industry toward a more secure software supply chain.

October 7, 2022
DevSecOps: Realities of Policy Management

Policy management is essential to scale cloud environments and is key to secure DevOps practices. It enables organizations to manage policies put in place that secure the cloud environment, ensure Kubernetes configurations are secure and enable the continuous monitoring of a company’s overall security posture.

As businesses migrate workloads across multi-cloud architectures to achieve the agility and scalability needed to keep up with the pace of digital transformation, the growing demands placed upon developers often leave a gap that exposes potential threats and risks in the configuration settings, making security an even greater focus in DevOps. In fact, IDC’s 2020 survey found that 67% of breaches in the cloud are caused by misconfigured applications or infrastructure, including some of the industry’s largest breaches like Marriott’s second breach.

To add to this, the first State of Policy Management report by Nirmata and the creators of the CNCF project Kyverno revealed that nearly 50% of users in cloud-native environments have now adopted some type of policy management solution. This tipping point of mainstream adoption across production cloud-native environments is making it critically important for DevOps teams to look at their practices and simplify and operationalize policy management across their Kubernetes stack by eliminating vulnerabilities through built-in, curated policies, without the barrier of learning complex policy languages. But this widespread adoption also acknowledges that organizations are finally realizing the need to put attention, investment and innovation into addressing security and compliance gaps as they adopt Kubernetes through proper DevSecOps practices and tools so applications being built can empower businesses.

To confidently build cloud applications in Kubernetes, DevSecOps teams need to accept these DevSecOps realities and apply policy management effectively.

Customization Creates Security Risks

Kubernetes can be highly customized, but DevSecOps teams need visibility into what’s happening in each cluster as organizations scale to ensure application reliability and security. Exploits on containers—including malware installation, cryptomining, host access and privilege escalation—offer opportunities for more security vulnerabilities. They can exist in images, production-accessible container registries, failed builds and third-party admission controllers in Kubernetes clusters.

To address these risks in applications running on Kubernetes, it’s important to protect your environment with three A’s: Authentication, authorization and admission. This should be done at the cluster layer which enables secure access to authenticated entities that are authorized to perform certain actions. One way to accomplish this is through policy management. In fact, according to the State of Policy Management report, the top use case for policy management is for Kubernetes admission control (31%). When a request is authorized, having a policy in place ensures the request goes through another set of filters. For example, an authorized request may be rejected by an admission controller due to quotas or due to other higher-priority requests. In addition to validation, admission webhooks can also mutate incoming requests as a way of processing request objects for use before reaching the Kubernetes API server.

Configuration Issues

Container images, namespaces, runtime privileges, persistent storage and control plane, together with network policies that are not compatible with best practices, are a source of misconfiguration and risk exposures. It’s this potential for greater risk exposures that have led configuration management to be a key driver of policy management adoption. In the Nirmata State of Policy Management report, it ranked third in security tools that are adopted today and fourth for the organization’s plans for future adoption.

There are several ways to define security policies to protect cloud environments. Policies can be used for auditing purposes, to reject pod creation or to mutate the pod and limit what it can do. By default, pods can receive traffic from any source and send traffic to any destination. Network policies allow you to limit the ingress and egress access for your pods. The network policy typically translates to firewall rules.

Lack of Adequate Authorization

Cloud authentication allows authorized users to securely access information stored in the cloud with authentication provided through cloud-based services. In The State of Policy Management report, key findings revealed that more than 24% of respondents today are using tools like policy management to authenticate users accessing applications. With data theft one of the fastest-growing and most expensive cybercrimes, the ability to process information and have strong authorization measures needs to be part of DevSecOps best practices.

In Kubernetes environments, as a user request is authenticated, it goes through an authorization workflow that decides if the request should be granted. It evaluates the request attributes against all policies and allows or denies the request. The main authorization mechanism is role-based access control (RBAC). Each authenticated request has an HTTP verb like GET, POST or DELETE, and authenticated entities have a role that allows or denies the request. Other authorization mechanisms include attribute-based access control (ABAC), node authorization and webhook mode.

As the trend of moving security further to the left in the application life cycle accelerates, developers are being required to take active responsibility for it, which creates a higher desire for automation. The rapid releases can expose applications to many vulnerabilities, raising the risk of a breach. With DevSecOps, organizations can transform the development pipeline by shifting security and compliance to the left, enabling developers to check the code before every commit. In doing so, security and compliance vulnerabilities can be identified and fixed in development, saving the organization from high costs and negative publicity from potential breaches.

There’s no doubt that Kubernetes is complex and challenging to adopt. On top of this, the development landscape is flooded with tools and more demands are being placed on engineers. These shifts are changing the traditional role of a developer, leaving a gap for organizations to address to get the most out of DevOps. But by taking a secure, continuous, iterative approach that also includes policy management, companies can reduce the risk and exposure of their cloud environments. The more mature an organization’s DevOps practices are, then generally, the stronger the security and compliance practices are—they grow in relation to each other. The most innovative companies accept policy management in DevSecOps as a necessity of development and adopt some level of policy management best practices. With the right implementation tools like policy management and security and compliance best practices, organizations can remain efficient in agile and DevOps while adhering to critical go-live deadlines—which can’t be missed in this fast-paced business environment.

May 6, 2022