Definition
Policy as code expresses policy in a machine-readable form that software can evaluate. Instead of leaving a rule only in a handbook, a team can version it, review changes, run tests against examples, and apply the same decision logic across environments.
Good policy code separates the rule from the application that requests a decision. Inputs should be explicit, outputs should explain which rule matched, and changes should carry authorship and review history. Tests need both allowed and denied cases, including edge conditions where two rules conflict.
The location of enforcement still matters. A policy engine can return "deny," but the system is not protected if the caller can ignore that answer or invoke the underlying capability through another path.
Distinguish it from nearby terms
Configuration as code records desired system settings. Policy as code evaluates whether a proposed state or action is allowed. A guardrail may implement a policy, but the term also covers advisory and detective controls that do not enforce one.
Check your understanding
An agent asks a policy service whether it may deploy to production, receives a denial, and calls the deployment API anyway. The rule is machine-readable, but it is not an effective boundary until the deployment path enforces the decision.