Intent must be executable
Governance that exists only as a document is aspiration, not governance.
Programmable Assurance
Intent should align with outcomes.
Section titled “Intent should align with outcomes.”Programmable Assurance is the discipline of continuously aligning organizational intent with outcomes through executable governance, accountability, evidence, and feedback.
Read the definition → Read the manifesto →
The Problem
Section titled “The Problem”Modern organizations run on software.
Infrastructure is programmable. Identity is programmable. Security is programmable. AI systems are programmable.
Governance is not.
Organizations define intent in one place, execute it somewhere else, measure it somewhere else, and explain it nowhere.
That gap — unverified, unrecorded, unaccountable — is where governance failures live.
The Four Principles
Section titled “The Four Principles”Enforcement must be continuous
Annual audits measure the past. Governance must run at the speed of change.
Every decision must be accountable
Named person, named policy, named date. Always.
Outcomes must feed back into intent
Governance that does not learn eventually becomes wrong.
Explore the Discipline
Section titled “Explore the Discipline”What Is Programmable Assurance?The canonical definition, scope boundary, and relationship to adjacent concepts.
The ManifestoWhy the discipline exists and what it stands for.
HistoryFrom control theory to GRC to Policy-as-Code — the intellectual lineage.
VocabularyThe canonical language of the discipline.
Category MapHow PA relates to GRC, Policy-as-Code, Zero Trust, and Platform Engineering.
ImplementationsPlatforms implementing Programmable Assurance.
First Implementation
Section titled “First Implementation”ObsidianWall is the first platform built to implement Programmable Assurance, starting in the infrastructure domain.