---
title: "Policy as code · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/policy-as-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Policy as code

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Scan infrastructure code on every change, test your own rules against the plan, block dangerous actions at the organization level, and let exceptions expire.

Policy as code turns infrastructure rules into checks that pass or fail. Some checks run on the code before anything changes. Others sit in the cloud and refuse a call even from an admin. Together they catch the mistakes a review misses. They follow the [rules as code](https://agentwranglers.se/playbook/engineering/rules-as-code/check-every-rule-in-code) idea from the engineering playbook.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/policy-as-code`.

## Required

- [Scan infrastructure code on every change](https://agentwranglers.se/playbook/infrastructure/policy-as-code/scan-infrastructure-code): Run an infrastructure scanner on every pull request, and fail the build on any finding rated high or critical.
- [Block dangerous actions for the whole organization](https://agentwranglers.se/playbook/infrastructure/policy-as-code/cloud-guardrails): Set organization-wide policies that refuse the most dangerous actions in every account, even for admins.

## Recommended

- [Test your own rules against the plan](https://agentwranglers.se/playbook/infrastructure/policy-as-code/policy-on-the-plan): Write the house rules that no scanner knows as policies, and run them against the plan in CI. Examples are the allowed regions, the required tags and the largest server size.
- [Let every exception expire](https://agentwranglers.se/playbook/infrastructure/policy-as-code/expiring-policy-exceptions): Give every skipped check a reason, an owner and an end date in the code. Fail the build once the date has passed.
- [Test infrastructure modules](https://agentwranglers.se/playbook/infrastructure/policy-as-code/test-infrastructure-modules): Give every shared module tests that check its plan, and run them in CI on every change to the module.

- Previous: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- Next: [Servers](https://agentwranglers.se/playbook/infrastructure/servers)
- [All chapters](https://agentwranglers.se/playbook/infrastructure)