Policy as Code

A policy in a PDF is a wish; a policy as code is a fact about the platform. Policy-as-code takes individual governance policies — "personal data never lands unmasked in the exposure layer", "every table has an owner", "metric definitions require review" — and expresses each one as an executable, versioned rule that the platform evaluates automatically, in CI or at generation time. The unit of the concept is the single policy, and that is what gives it its engineering properties. Each policy gets a lifecycle: it is proposed in a pull request, reviewed by the people accountable for it, tested against known-good and known-bad cases, versioned so you can answer "what did the policy say in March?", and enforced by machinery rather than memos. Exceptions become explicit, reviewable code paths instead of quiet Slack agreements. Closely related to governance-as-code — the sibling that names the whole governance layer built this way; policy-as-code is its atom. And in MDDE the natural home for these rules is the metadata layer itself, following the same versioned-artifact discipline as metadata-as-code: a policy over models and metadata can be checked before anything is generated, which is where enforcement is cheapest.