A Prompt Is a Wiki That Talks Back

If you are regulated, at some point somebody asks for evidence as a control. There is an enormous difference between "we have a policy that says engineers shouldn't do this" and "here is the webhook that structurally prevents it, here is its configuration, and here is the admission log showing it firing." One of those is a conversation you have with an auditor. The other one is a finding. An advisory control can only ever be evidenced by asking people whether they followed it. Which is why it gets twitchy when someone says they put it in the prompt — because a prompt is a wiki that talks back. Full talk — policy as code on two real clusters, OPA Gatekeeper vs Kyverno: https://youtu.be/Cz_Bgg8wedM #kubernetes #policyascode #compliance #devsecops #shorts