Compliance-as-Code: Automating Evidence Collection with Human-in-the-Loop Review

Rahul Muralinath

International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 2026, vol. 12, issue 5, 305-313

Abstract: Security and compliance frameworks generally require proof that a control functions continuously, not that it was configured correctly once. Most organizations still produce that proof by hand - a captured screenshot, a spreadsheet entry, a forwarded confirmation email - a method built for a slower era of infrastructure change and poorly suited to systems provisioned, modified, and redeployed through code on a near-continuous basis. This article examines an architectural alternative: embedding evidence generation directly into the internal developer platform that already governs provisioning and deployment, so a control's operating state is captured as a byproduct of normal platform activity rather than reconstructed after the fact for an auditor. Written from a platform-engineering vantage point - grounded in experience building golden-path developer tooling and platform-embedded policy enforcement - rather than from compliance practice, its central claim is narrower than "automate compliance": evidence gathering belongs at the platform layer, but the determination that gathered evidence actually satisfies a control's intent should remain a deliberately structured human decision. Recent empirical work on infrastructure-as-code security posture and pipeline misconfiguration rates supports continuous, machine-gathered evidence over periodic manual sampling; separate research on human oversight of automated recommendations complicates the assumption that adding a human reviewer automatically improves decision quality, and that complication shapes how the review layer proposed here is designed. The article closes by considering what it takes, organizationally, to move a compliance function that has long operated on manual habit toward this platform-centered model.

Keywords: compliance-as-code; continuous compliance; human-in-the-loop; security automation; policy-as-code; internal developer platforms; audit evidence; risk management (search for similar items in EconPapers)
Date: 2026
Note: Article URL: https://ijsrcseit.com/home/article/view/CSEIT2612528
References: Add references at CitEc
Citations:

Downloads: (external link)
https://ijsrcseit.com/home/article/view/CSEIT2612528 Article URL (text/html)
https://ijsrcseit.com/home/article/download/CSEIT2612528/CSEIT2612528 Full text (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:jbh:ijsrcs:v12:y2026:i5:id:2178

DOI: 10.32628/CSEIT2612528

Access Statistics for this article

More articles in International Journal of Scientific Research in Computer Science, Engineering and Information Technology from International Journal of Scientific Research in Computer Science, Engineering and Information Technology
Bibliographic data for series maintained by Pankaj Sharma ().