Governance as Code.
Policy is the rules. Governance is the system around them: who decides, how decisions are recorded, how oversight happens, and what becomes of exceptions. That system can be encoded too.
Beyond the rules: who decides, and where it’s recorded.
Platform teams reached this layer after policy as code proved itself. A single rule that blocks an unencrypted bucket is policy; the account-vending machinery, the org-wide guardrails, the review boards replaced by codified escalation paths, all of that is governance expressed as configuration rather than as a committee’s habits.
The practical difference shows up in questions. Policy answers “is this change allowed?” Governance answers “who was allowed to decide that, where is the decision recorded, and who is watching the watchers?”
The operating model, encoded.
A PMO is mostly governance, which is why this member of the family maps so directly. Each element of the operating model has an encoded form running in the reference deployments:
Exceptions complete the model. A governed exception carries a label a person applied deliberately, visible in history, never applied by automation, so deviating from the rule is possible and remembering the deviation is guaranteed.
What stays human.
The decisions. Code carries the record, the enforcement, and the escalation path; it does not decide whether the business case is sound or the risk is worth accepting. Governance as code removes the clerical layer between a decision-maker and a trustworthy record, and leaves the judgment where it belongs.