I Already Solved This

It is always the same meeting. Somewhere in every enterprise a risk standard lives in a shared drive, its version a number typed into the footer, its last three changes emailed around as attachments with initials in the filename, and nobody can say which copy is authoritative. Someone proposes a review step, and a small, tired part of my brain lights up with recognition. I have seen this exact problem. I spent a career solving it. It just had a different file extension.

That recognition is the whole point. Software engineering spent decades building a governed lifecycle for one class of deliverable, and every other versionable artifact in the enterprise is sitting at a stage software already grew out of. What changed recently is that AI made running that lifecycle cheap enough to finally point at all of them.

The one artifact class that got a lifecycle

Think about what “governed” actually means for source code. There is a single source of truth in version control. Every change enters as a tracked request. A human other than the author reviews it, and approval gates the merge. Then a pipeline builds it, tests it, scans it, and promotes it through environments to production, with observability watching the whole way. The loop closes and starts again.

Now think about how a policy, a standard, an architecture decision, a procedure, or a risk register actually moves through most enterprises. It lives in SharePoint or a wiki or an inbox. There is no diff. There is no gate. There is no test that fails when the change is wrong. The version is a social convention, not a system guarantee.

This is not because those artifacts matter less. A misapplied control or a stale procedure can cost more than a bad commit. It is because, for fifty years, exactly one deliverable earned the full discipline, and everything else ran on trust and email.

It took us twenty-five years to earn it

Here is the part I want to be honest about, because it is easy to romanticize. Software did not always have this. The governed lifecycle was not handed down whole. It accreted, painfully, across my career, through a series of inflection points that each dragged more of the work under version control and automation.

The Agile Manifesto in 2001 changed how change itself was proposed and sized. Test-driven development made correctness an executable artifact instead of a hope. Continuous integration made “does it still build” a question answered on every commit instead of once a quarter. DevOps, around 2009, tore down the wall between the people who wrote the change and the people who ran it. And GitOps, coined in 2017, made the git repository the single declared source of truth that the running system reconciles itself against.

None of those arrived free. Each was a decade of tooling, argument, and habit change. We earned this. So when I say I already solved this, I do not mean I fixed it once thirty years ago. I mean I watched an entire industry grind out a discipline over my whole career, and I now recognize, instantly, that the risk standard in that shared drive is sitting somewhere around the pre-2001 stage. The déjà vu is not nostalgia. It is a map. We already know the whole path out, because we walked it.

For code, the discipline was obviously worth the cost, because a bad merge broke production at two in the morning. For a policy document, the blast radius was diffuse and slow, so the felt cost of chaos stayed below the cost of the discipline. The enterprise quietly ran two speeds: code under a hard-won governed lifecycle, and everything else under vibes.

The dark factory changed the math

What tips the balance is that the loop got cheap to run.

The dark factory, the lights-out plant that runs without humans on the floor, was manufacturing’s version of this shift. AI is doing it for knowledge work. An agent can draft the change, open the pull request, write the test that guards it, record the decision that justified it, and shepherd it through the gates. Not for code alone. For any artifact you can represent as text or structured data.

That matters because the barrier was never conceptual. Everyone understood that a standard would be safer under version control with a review gate. The barrier was labor. Running the full lifecycle by hand for every policy and procedure cost more attention than the risk seemed to justify. Collapse the labor cost and the calculation inverts. The discipline that was affordable only for source code becomes affordable for everything.

I have written before that the reconciliation loop, desired state declared in git and driven toward reality by an executor, is not new. What is new is the executor. It used to be deterministic. Now it can be probabilistic, and its reach extends to artifacts no Terraform provider ever covered. And as I argued in The Machine Has Better Discipline Than Your Team, the agent that fills the ticket and records the decision every single time turns out to be a better audit citizen than the humans it assists. Writing the artifact was never the bottleneck. Governing it was.

The dominoes

Watch the order in which the dominoes fall, because it is not random. Each one is the same move applied to a new artifact.

Infrastructure fell first. Infrastructure as Code plus GitOps turned servers and networks into a declared, versioned artifact that a reconciler drives toward desired state. That is the proof of concept for everything that follows, and I have written about the organizational gap between generating that code and actually deploying it.

Architecture fell next. In Architecture Is the Prompt I made the case that the architecture model belongs in git as a queryable corpus, where governance lives in the diff rather than in a slide reviewed once a year.

Policy is falling now, as rules become executable checks instead of prose nobody runs. And the hardest domino, the governance and risk layer, the standards and procedures and controls that regulators actually care about, is next. I explored one edge of that in SR 11-7 Was Written for Models That Don’t Argue Back. The pattern underneath every one of these is identical: take a governed deliverable out of the document graveyard and put it under the software lifecycle.

Compile the policy, not just the code

Let me make this concrete, because “everything as code” collapses into hand-waving if you cannot name the equivalents. Take that risk standard from the top of this post and walk it through the software chain.

Authoring stays in the tools people know, the office suite and the diagramming app. That does not change. Source of truth moves from a shared folder full of standard_v3_final_FINAL.docx to a versioned store where history is a system guarantee, not a naming convention. A change request becomes a real ticket instead of an email thread.

Then the interesting part. The build step renders the published artifact from source, the way a compiler produces a binary, so the PDF everyone reads is generated, not hand-edited. The test step is where governance becomes executable: policy-as-code conformance, schema validation, and control-mapping checks that run in a throwaway environment, the documentation equivalent of spinning up a disposable test container. Package and version publishes the approved artifact with an immutable version into a governed registry, so the version lives in the system, not in the footer. Deploy promotes it through draft, review, approved, and published, into the portal or content system where it is actually consumed, with sign-off gates the whole way.

An orchestrator moves it between those states. Sometimes that is a workflow engine. Sometimes it is reconciliation against a declared desired state, the same pattern ArgoCD runs for Kubernetes, applied to “this document should be published in this form.” None of these are inventions. They are renamings of primitives software has run for years.

The center is a source of truth you can version

Do this across every domain and a shape emerges. The center of an AI-first enterprise is a source of truth that is stored and versioned. The medium changes with the shape of the data, but the property does not.

Text-shaped artifacts, the policies and standards and architecture decisions, belong in git, as markdown with frontmatter, because they are small and diffable and read well in a pull request. Unstructured content at volume, the media and the large corpora, belongs in an object store or a data-lake lineage where snapshots and table formats provide the versioning git cannot scale to. Structured data at scale belongs in a lakehouse, Databricks or Snowflake or Data 360, where table-format time travel is, quite literally, version control for data.

Three substrates, one invariant. Versioned. Diffable or time-travelable. Governed. And indexable. That last word is the whole game, because indexability is what makes every domain of the business legible to an agent. A source of truth the AI cannot search is just expensive storage.

The tools in each lane are swappable. Trunk-based development and feature flags for the review flow. A ticketing system sized to the team. A pipeline with the test, security, and observability gates the domain demands. Swap any of them by scale and deliverable type. The loop underneath stays invariant. That invariance is the reason the pattern travels.

This is only the semantic half of Context

I want to be careful not to oversell what this builds, because it is one piece of a larger machine. Think of the AI-first enterprise as an operating system with four pillars: Context, the searchable state of the business; Prompt, the new programming language for expressing intent; Model, the intelligence level a given task requires; and Tools, the actions the system can take. Each of those has to be solved at every scale, from the individual to the team to the line of business to the enterprise.

Everything as code builds one pillar, Context, and only half of it. Context itself has two layers. The semantic layer is the governed, versioned meaning of the business, the model and the policies and the architecture, and that is what this entire post has been about. The memory layer is the other half, and it is a different problem. Grounding an AI turns out to be a memory problem, and the practical answer has been the second brain, at every scale from a person’s notes to an enterprise knowledge base. Every memory framework in the field keeps rediscovering what neuroscience has studied for decades and still finds partly mysterious. I have circled it in Context Engineering Is Infrastructure and The Second Brain Doesn’t Ship, and it deserves its own treatment.

The reason IT gets to go first on any of this is simple. IT already runs the blueprint. The governed lifecycle, the versioned source of truth, the reconciliation loop, these are not aspirations in software, they are Tuesday. IT is the reference implementation the rest of the enterprise copies. This series walks the rest of the copy: the domains, the substrate, the review problem, the memory layer, and the full four-pillar operating system.

What the loop can’t automate

Two honest limits, because the pattern is not a magic wand.

The first is that review does not transfer cleanly. A code review gate works partly because the machine can run the test and tell you, objectively, that something broke. For a policy or a standard, “does this pass” is often a human judgment, and one word can move a control. The gate that was built for a human reviewing a code diff strains against prose where meaning is the payload. And automating a broken governance process does not fix it. As I have argued, automating chaos produces automated chaos, faster. If your standards were incoherent on the shared drive, they will be incoherent in git, just with better version history.

The second is the part that stays human no matter how cheap the loop gets. Authoring the intent. Owning the accountability. Deciding what “correct” even means for a control that protects real people and real money. The lifecycle is a conveyor belt. It moves artifacts through states with discipline. It does not choose the destination, and it never will.

So I keep having the déjà vu, and I have decided to treat it as a gift rather than a frustration. The enterprise does not need to invent a new governance discipline for the AI era. It needs to generalize the one software spent twenty-five years earning, and point the cheap new executor at every artifact that was left out the first time. I already solved this. We all did. We just have to remember where we put the answer.

---

If this resonated, read Documentation Is the Code Now, on the inversion where the document becomes the source and the system is generated from it, and The Reconciliation Loop, on the desired-state pattern this whole thesis generalizes. Both are early stops on the Everything as Code series.

Find me on X @orestesgarcia or LinkedIn /in/setsero.