| name | policy-as-code-engineer |
| description | Create and review policies for OPA/Rego, Kyverno, GitLab Policies, Conftest, Checkov, Terraform, Kubernetes, and CI/CD gates. |
| version | 1.0.0 |
| since | 2026-07-28 |
| last_modified | 2026-07-28 |
| authors | ["platform-engineering"] |
| stability | stable |
| min_platform_version | {"codex":"unknown","amazon-q":"unknown","antigravity":"unknown","auggie":"unknown","bob":"unknown","claude-code":"unknown","cline":"unknown","codebuddy":"unknown","continue":"unknown","costrict":"unknown","crush":"unknown","github-copilot":"unknown","gitlab-duo":"unknown","factory":"unknown","forgecode":"unknown","opencode":"unknown","openhands":"unknown","cursor":"unknown","roo-code":"unknown","kiro":"unknown","junie":"unknown","gemini-cli":"unknown","iflow":"unknown","kilocode":"unknown","kimi":"unknown","lingma":"unknown","pi":"unknown","qoder":"unknown","qwen":"unknown","windsurf":"unknown","ollama":"unknown"} |
| deprecated_since | null |
| replaces | null |
| supersedes | [] |
| changelog | [{"version":"1.0.0","date":"2026-07-28","change":"Initial generated production-ready SDLC / DevSecOps skill"}] |
Policy As Code Engineer
Purpose
Create and review policies for OPA/Rego, Kyverno, GitLab Policies, Conftest, Checkov, Terraform, Kubernetes, and CI/CD gates. Treat regulatory, security, and operational references as review and evidence guidance, not legal advice.
When to use
- policy-as-code engineering decisions, controls, or operating practices need independent review.
- A change affects policy-as-code engineering artifacts such as Rego policy, Kyverno rule, GitLab policy, Conftest suite, Checkov check, CI gate.
- The user needs evidence-oriented findings for risks such as overbroad deny rule, missing test fixture, policy bypass, false-positive flood, unversioned exception, weak enforcement mode.
- Audit, security, operations, or platform stakeholders need a concise readiness position.
- Existing documentation, tickets, tests, or logs must be turned into actionable remediation items.
Operating model
- Identify the relevant policy-as-code engineering artifacts, owners, systems, environments, and review boundary.
- Compare the available artifacts against expected signals such as policy test, violation example, exception record, enforcement mode, coverage report, gate result.
- Separate confirmed gaps from assumptions, missing evidence, and advisory improvement opportunities.
- Rate findings by operational, security, compliance, customer, and auditability impact.
- Recommend minimal remediation steps, validation evidence, owners, and review cadence.
Spec-Driven Change Context
- Treat repository specs, ADRs, runbooks, change proposals, design notes, and task files as durable context that outlives a chat session.
- For non-trivial changes, prefer a checked-in change artifact or equivalent proposal/design/tasks record before implementation begins.
- Capture requirement deltas explicitly: added, modified, removed, deprecated, or unchanged behavior.
- Keep implementation tasks traceable to acceptance criteria, affected specs, validation commands, and owners.
- During verification, compare the implementation against the proposal, design decisions, task checklist, and spec deltas.
- After completion, sync or archive completed change artifacts so the repository's source of truth reflects the final behavior.
- If the repository has no spec workflow yet, report the missing artifact and provide a minimal proposal/spec/tasks outline instead of relying on chat-only intent.
Skill-Specific Review Scope
- Primary artifacts: Rego policy, Kyverno rule, GitLab policy, Conftest suite, Checkov check, CI gate.
- Risk themes: overbroad deny rule, missing test fixture, policy bypass, false-positive flood, unversioned exception, weak enforcement mode.
