What is GitOps (Policy)?
GitOps for policy is the practice of using git as the single source of truth for AI agent security policies. All policy changes go through pull requests, automated testing, and CI/CD deployment pipelines — ensuring that the policies enforced by PolicyLayer always match the reviewed and approved state in git.
WHY IT MATTERS
GitOps is an operational model where the desired state of a system is declared in a git repository, and automated processes ensure the actual state matches the declared state. Originally applied to Kubernetes deployments (popularised by Weaveworks), the pattern applies equally well to policy management. The git repository is the authority — if a policy exists in git, it's enforced. If it doesn't, it isn't.
For AI agent security policies, GitOps provides several critical guarantees. Auditability: every policy change is a git commit with an author, timestamp, and review trail. Reproducibility: the exact policy state at any point in history can be reconstructed from the git log. Consistency: automated deployment ensures all PolicyLayer instances enforce the same policy version. Recoverability: if something goes wrong, rollback is a git revert.
The GitOps workflow for policies looks like: an engineer or security analyst creates a branch, modifies a YAML policy file, opens a pull request, and requests review. CI runs policy linting and testing. A reviewer (often from the security team) approves or requests changes. On merge, CD deploys the updated policy to PolicyLayer instances. The entire process is automated, auditable, and consistent.
This is a significant improvement over traditional policy management, where changes might be made through a web UI with no review process, no testing, and no easy rollback. GitOps makes policy management as rigorous as code deployment — because it is code deployment.
HOW POLICYLAYER USES THIS
PolicyLayer is designed for GitOps workflows. Policies are YAML files that live in a git repository and are deployed to the proxy via CI/CD. The proxy reads policies from the filesystem, so deployment is a file update followed by a reload signal. Organisations can use any GitOps tool — Argo CD, Flux, GitHub Actions, GitLab CI — to automate the deployment pipeline. The git repository serves as the audit trail, the review platform, and the rollback mechanism, all without any additional PolicyLayer-specific infrastructure.