We write infrastructure policy against the classes and relationships in a model of your estate, not against the names of resources, so that a rule written once holds for everything it describes, including what does not exist yet.
Rules that name things go stale
A rule that says “the payments database must not be reachable from the public subnet” is correct until the database is renamed, replicated or moved. Each of those events silently breaks the rule without breaking anything visible. Policy that lists resources by name is a snapshot, and snapshots age.
Rules that name classes do not
If the model states that a resource is an instance of a class that carries cardholder data, the rule can be written about the class: no instance of that class may be reachable from a network segment of the public class. A new replica inherits the rule by being what it is. The rule has no list to maintain.
Orchestration reads the same model
We drive resource orchestration from the same graph the policy reads. When a capability is scaled, the resources created for it are classified on creation, and the policies that apply to that class apply at once. Configuration that would violate a rule is refused before it is applied, not discovered afterwards.
Reconciliation closes the loop
The model is only useful if it is true, so we reconcile it continuously against what the cloud reports. A resource that appears without a place in the model is a finding, not an unknown. Your policy is then a set of statements about a model you can trust, evaluated against an estate the model describes.
