v1
The as-code family

Compliance as Code.

Compliance is proving to someone outside that your controls hold. The as-code version checks the controls by machine and lets the evidence accumulate as a by-product of working, instead of being excavated once a year.

The practice: controls as executable tests.

Infrastructure teams turned compliance baselines into executable tests: Chef’s InSpec expressed entire compliance profiles as code that runs against real systems, and OpenSCAP did the same for hardening standards. A control stopped being a sentence in a binder and became a check with a pass or a fail and a timestamp.

The consequence that matters is continuity. When controls run on every change, compliance is a property the system has all year, and the audit becomes a read of the record rather than a reconstruction of it.

Evidence as a by-product.

The questions an auditor asks a PMO have machine-collected answers here, and each answer is generated by the ordinary act of working:

Who approved this, under what?
A merged pull request with a named reviewer, timestamped, showing the exact document version and the criteria it passed. Nobody hunts for the email thread.
Does every requirement have a test?
The traceability matrix regenerates on every change, so coverage is provable on demand rather than asserted from memory.
Were the checks actually run?
Every gate run is retained in the Actions history with its verdict, on the exact commit it judged.
Where a signature is legally required?
A required reviewer models it, and the sign-off lands in the merge record. The regulated-industry profile expects the heavier document set from the start.

What it does not claim.

Passing your own checks is not certification. Compliance as code makes evidence cheap, current, and complete; the bar itself is still set by the framework and judged by the auditor. PMO as Code ships the mechanics, and it makes no certification claims on your behalf or its own.

Where human gates still belong → The regulated-industry profile →