Compliance-as-Code
Compliance-as-Code is the practice of defining compliance controls, policies, and their verification as code that lives in version control, runs in CI/CD, and fails builds or raises alerts when requirements are not met — making compliance testable and auditable like any other software behaviour.
Explanation
When a control is code, it inherits everything good about code: review, history, testing, and automation. A policy-as-code rule can block a non-compliant deploy; a test can assert encryption is enabled; a pipeline can attest that a control ran.
Compliance-as-Code is a core technique of Compliance Engineering and a prerequisite for evidence-native operation.
Why it matters
Versioned controls make change auditable and drift detectable — you can prove exactly when and why a control changed.
Automated enforcement prevents non-compliant states from ever reaching production.
How StackWeaver applies it
StackWeaver implements policy-as-code and control tests in the client's existing pipelines, so enforcement and evidence are automatic.
What this relates to
- Compliance EngineeringTreating compliance as something built into systems through engineering — enforced, tested, and monitored — rather than added through documentation.
- Engineering ControlsControls implemented and enforced through engineering systems — configuration, code, and automation — rather than through policy and manual process.
- Evidence-Native SystemsSystems where compliance proof is a property of how they operate — captured at the source — not a document produced under deadline.