Infrastructure Policy as Code
Infrastructure Policy as Code reviews every proposed change to our cloud environments against written security policy, and blocks changes that would breach it.
Keywords
- Tags: Cloud
- Tags: Security
- Tags: Automation
- Tags: Compliance
- Stage: Production
- Type: Rule engine with language model explanations
- Sector: Public administration
- Language: English
How does our product work?
Policies are written once, as code, and evaluated against the plan for a change before anything is created. Where a change is refused, a language model turns the failing rule into a plain-English explanation for the engineer who proposed it.
The decision itself is made by the rule engine and is fully deterministic. The model only writes the explanation, and cannot alter the outcome.
Overview
Cloud misconfiguration is the most common cause of avoidable data exposure in government. Reviewing changes by hand does not scale to the number of changes we make each week.
This system moves the review to the moment of change and makes it consistent. Engineers get an answer in seconds instead of days, and the same rule is applied to everyone.
Owner and responsibility
More detailed information on the system
Here you can get acquainted with the information used by the system, the operating logic, and its governance in the areas that interest you.
System description
The rule engine evaluates around 300 policies covering encryption, network exposure, identity permissions and data residency. A refusal names the rule, the resource and the specific attribute at fault.
Because the explanation is generated, it is always shown alongside the raw rule output so the engineer can check the explanation against the source of truth.
References
Policy catalogue, published internally and reviewed twice a year.