Governance-as-Code: When Compliance Comes From Git

← All Articles

Governance-as-Code: Policy Meets Version Control

Classic compliance runs on Word documents, PDFs, and SharePoint folders. Nobody reads them. Nobody knows which version is current. Audits turn into a nightmare.

Governance-as-Code fixes this structurally.

What Is Governance-as-Code?

All policies, guidelines, thresholds, and approval logic are versioned as machine-readable files (YAML, JSON) in Git:

# HITL-BOUNDARY-POLICY.yaml
rules:
  - action: production-deploy
    decision: HITL
    reason: Irreversible, production impact
  - action: read-only-query
    decision: AUTO
    reason: No risk, fully reversible

Why That’s Better

Classic	Governance-as-Code
PDF in SharePoint	YAML in Git
Updated manually	Versioned, diffable
Ignored	Machine-enforced
Audit prep: weeks	Audit report: automatic

IIO’s Implementation

The IIO framework has over 400 governance files in Git:

• Approval policies (HITL boundary policy)
• Data protection rules (CDT levels)
• Cost controls (cost control policy)
• Compliance evidence (evidence trail)

Every change is traceable. Every decision is auditable.

Governance implementation for your organisation →

What Governance-as-Code Actually Means

Traditional IT governance lives in Word documents, SharePoint folders, and email threads. Governance-as-Code brings the same principles into code:

# Example: HITL gate definition in YAML
gate_id: gate.production-deploy
title: Production deployment approval
risk_level: HIGH
approvers:
  - role: operator_admin
auto_conditions:
  - infra_mode: standard
  - branch: feature/*
block_conditions:
  - actor_trust: L0
  - infra_mode: storm

The Four Principles

1. Versionable — Governance changes are traceable in the Git log. Who changed which policy, and when?

2. Testable — Policy tests run in the CI/CD pipeline. No deployment without a governance check.

3. Auditable — Machine-readable evidence files for every decision point. Auditors receive complete packages without manual preparation.

4. Automatically enforceable — Policies are automatically blocked on violation — not just documented.

Real-World Example: Payroll Approval

Without Governance-as-Code: spreadsheet → approval by email → manual posting. With Governance-as-Code: calculation runs automatically → HITL gate opens → reviewer sees the diff → click → SEPA file generated.

Result: 70% fewer manual steps, 100% audit trail.

IIO platform architecture →