What it means
Policies can evaluate infrastructure definitions before deployment, inspect live resources, block prohibited changes, or trigger remediation and evidence collection.
Why it matters
Machine enforcement reduces ambiguity and delay, but the rule still depends on correct intent, scope, exceptions, testing, and ownership.
Practical focus
- Translate a clear policy objective into testable conditions
- Test rules against valid and invalid examples
- Version rules with owners and change history
- Design exceptions that are visible and time limited
Common mistakes
- Encoding vague policy without resolving meaning
- Deploying rules that break legitimate recovery or operations
- Treating a passing scan as proof of security
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: