Policy as code and deployment gates
Policy-as-code gates articles
Gates at pull request, pipeline and admission time, written as policy, explainable, recorded and fail-closed.
Policy as code expresses security rules as versioned, testable code, and deployment gates enforce them at pull request, pipeline and admission time. These articles cover writing CI/CD gates with Open Policy Agent and why gates should fail closed instead of counting severities.
- Rollback security: reassess the release you restoreReview rollback security with exact artefact identity, current evidence and dependency checks so an older release does not inherit an outdated approval. · Sujan Singh
- Policy-as-code testing: verify release decisionsTest policy-as-code release decisions with explicit inputs, negative fixtures and failure cases before promoting a gate into the delivery workflow. · Sujan Singh
- Fail-closed deployment gates: why severity counts failFail-closed gates built on severity counts get routed around. Use reachability, exposure, ownership and recorded overrides to keep them trusted. · Sujan Singh
- Policy as code for deployment gates with OPA and RegoPolicy as code with OPA and Rego turns deployment gates into testable rules that explain every decision at pull request, pipeline and admission. · Sujan Singh
See it on your stack
See connected security in action.
Explore the workflow with your engineering, security and compliance teams. No repository access is needed for the initial demonstration.