Compliance-as-code architecture (Capital One - Discover)

Compliance work becomes more durable when controls are represented as executable rules, observable state, and reviewable evidence rather than static documents.

This pattern treats platform configuration, identity boundaries, network exposure, and deployment posture as queryable inputs. Policy checks can then run during design review, build workflows, and operational audits.

The architecture keeps human review in the loop for judgment-heavy decisions while automating repeatable checks that should not depend on memory or manual spreadsheet upkeep.