5 docs tagged with "policy-as-code"

Policy as Code is not one engine — it is a discipline. EnforceAuth supports multiple PDP families over time.

Policy as Code means authorization rules are written in a formal language, stored in version control, reviewed in pull requests, tested in CI, and promoted across environments — the same lifecycle as application code.

Authentication answers who is signing in. Authorization answers what they are allowed to do once inside — at runtime, in context, for humans, services, and AI agents.

Moving to Policy as Code is not a single flip — it is a sequence of decisions about where policies live, how they reach runtimes, and how you prove enforcement. This page helps you pick a path before you wire EnforceAuth.

Zift finds authorization logic buried in application code and helps you extract it into Policy as Code — Rego for OPA (what EnforceAuth deploys today) or Cedar for AWS Verified Permissions and other Cedar engines.