An Empirical Study of Policy-as-Code Adoption in Open-Source Software Projects

• URL: http://arxiv.org/abs/2601.05555v1
• Date: Fri, 09 Jan 2026 06:12:40 GMT
• Title: An Empirical Study of Policy-as-Code Adoption in Open-Source Software Projects
• Abstract summary: Policy-as-Code (PaC) has become a foundational approach for embedding governance, compliance, and security requirements directly into software systems.<n>While organizations increasingly adopt PaC tools, the software engineering community lacks an empirical understanding of how these tools are used in real-world development practices.<n>This paper aims to conduct the first large-scale study of PaC usage in open-source software.
• Score: 6.110108715076152
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: \textbf{Context:} Policy-as-Code (PaC) has become a foundational approach for embedding governance, compliance, and security requirements directly into software systems. While organizations increasingly adopt PaC tools, the software engineering community lacks an empirical understanding of how these tools are used in real-world development practices. \textbf{Objective:} This paper aims to bridge this gap by conducting the first large-scale study of PaC usage in open-source software. Our goal is to characterize how PaC tools are adopted, what purposes they serve, and what governance activities they support across diverse software ecosystems. \textbf{Method:} We analyzed 399 GitHub repositories using nine widely adopted PaC tools. Our mixed-methods approach combines quantitative analysis of tool usage and project characteristics with a qualitative investigation of policy files. We further employ a Large Language Model (LLM)--assisted classification pipeline, refined through expert validation, to derive a taxonomy of PaC usage consisting of 5 categories and 15 sub-categories. \textbf{Results:} Our study reveals substantial diversity in PaC adoption. PaC tools are frequently used in early-stage projects and are heavily oriented toward governance, configuration control, and documentation. We also observe emerging PaC usage in MLOps pipelines and strong co-usage patterns, such as between OPA and Gatekeeper. Our taxonomy highlights recurring governance intents. \textbf{Conclusion:} Our findings offer actionable insights for practitioners and tool developers. They highlight concrete usage patterns, emphasize actual PaC usage, and motivate opportunities for improving tool interoperability. This study lays the empirical foundation for future research on PaC practices and their role in ensuring trustworthy, compliant software systems.

Related papers

• A Decade of Bayesian Optimization for Controller Tuning and Robot Learning: Tutorial, Review, and Future Prospects [49.6839288052673]
  In the past decade, Bayesian optimization has emerged as a powerful framework for automatic controller tuning and robot learning.<n>This article offers a comprehensive overview of the state-of-the-art in BO, designed to support both researchers and practitioners in understanding recent advancements.
  arXiv  Detail & Related papers  (2026-09-08T19:59:54Z)
• GitHub Template Repositories: Served Domains, Maintenance, and Practitioner Guidelines [6.336805888164513]
  We conduct a large-scale empirical study of GitHub template repositories across the five most used programming languages.<n>We analyze the associations between repository characteristics and activity, and quality-related issues.<n>Our results show that Web Development is the predominant domain across ecosystems, while maintenance and quality issues vary by programming language.
  arXiv  Detail & Related papers  (2026-06-12T16:41:04Z)
• FlowRL: A Taxonomy and Modular Framework for Reinforcement Learning with Diffusion Policies [51.53039275043005]
  We introduce a comprehensive taxonomy for algorithms RL with diffusion/flow policies.<n>We provide benchmarks across Gym-Locomotion, DeepMind Control Suite, and IsaacLab.<n>Our work establishes a clear foundation for understanding and algorithm design.
  arXiv  Detail & Related papers  (2026-03-29T00:02:50Z)
• Tokenomics: Quantifying Where Tokens Are Used in Agentic Software Engineering [4.812321790984494]
  We conduct an analysis of token consumption patterns in an LLM-MA system within the Software Development Life Cycle (SDLC)<n>We analyze execution traces from 30 software development tasks performed by the ChatDev framework using a GPT-5 reasoning model.<n>Our preliminary findings show that the iterative Code Review stage accounts for the majority of token consumption for an average of 59.4% of tokens.
  arXiv  Detail & Related papers  (2026-01-20T20:52:14Z)
• DRBench: A Realistic Benchmark for Enterprise Deep Research [81.49694432639406]
  DRBench is a benchmark for evaluating AI agents on complex, open-ended deep research tasks in enterprise settings.<n>We release 15 deep research tasks across 10 domains, such as Sales, Cybersecurity, and Compliance.
  arXiv  Detail & Related papers  (2025-09-30T18:47:20Z)
• Rethinking Testing for LLM Applications: Characteristics, Challenges, and a Lightweight Interaction Protocol [83.83217247686402]
  Large Language Models (LLMs) have evolved from simple text generators into complex software systems that integrate retrieval augmentation, tool invocation, and multi-turn interactions.<n>Their inherent non-determinism, dynamism, and context dependence pose fundamental challenges for quality assurance.<n>This paper decomposes LLM applications into a three-layer architecture: textbftextitSystem Shell Layer, textbftextitPrompt Orchestration Layer, and textbftextitLLM Inference Core.
  arXiv  Detail & Related papers  (2025-08-28T13:00:28Z)
• An Empirical Study of Complexity, Heterogeneity, and Compliance of GitHub Actions Workflows [0.0]
  GitHub Actions (GHA) has emerged as a dominant service due to its deep integration with GitHub.<n>GHA provides official documentation and community-supported best practices.<n>This study will investigate the structure, complexity, and compliance of GHA in open-source software repositories.
  arXiv  Detail & Related papers  (2025-07-24T03:26:38Z)
• Deep Research Agents: A Systematic Examination And Roadmap [109.53237992384872]
  Deep Research (DR) agents are designed to tackle complex, multi-turn informational research tasks.<n>In this paper, we conduct a detailed analysis of the foundational technologies and architectural components that constitute DR agents.
  arXiv  Detail & Related papers  (2025-06-22T16:52:48Z)
• Towards Mixed-Criticality Software Architectures for Centralized HPC Platforms in Software-Defined Vehicles: A Systematic Literature Review [1.94470674081983]
  We set up a systematic review protocol grounded in established guidelines.<n>Third, we extract key functional domains, constraints, and enabling technologies that drive changes in automotive SWAs.<n>We propose an exemplary SWA for a microprocessor-based system-on-chip.
  arXiv  Detail & Related papers  (2025-06-06T07:40:30Z)
• A Controlled Study on Long Context Extension and Generalization in LLMs [85.4758128256142]
  Broad textual understanding and in-context learning require language models that utilize full document contexts. Due to the implementation challenges associated with directly training long-context models, many methods have been proposed for extending models to handle long contexts. We implement a controlled protocol for extension methods with a standardized evaluation, utilizing consistent base models and extension data.
  arXiv  Detail & Related papers  (2024-09-18T17:53:17Z)
• Towards Coarse-to-Fine Evaluation of Inference Efficiency for Large Language Models [95.96734086126469]
  Large language models (LLMs) can serve as the assistant to help users accomplish their jobs, and also support the development of advanced applications. For the wide application of LLMs, the inference efficiency is an essential concern, which has been widely studied in existing work. We perform a detailed coarse-to-fine analysis of the inference performance of various code libraries.
  arXiv  Detail & Related papers  (2024-04-17T15:57:50Z)
• Exploring Security Practices in Infrastructure as Code: An Empirical Study [54.669404064111795]
  Cloud computing has become popular thanks to the widespread use of Infrastructure as Code (IaC) tools. scripting process does not automatically prevent practitioners from introducing misconfigurations, vulnerabilities, or privacy risks. Ensuring security relies on practitioners understanding and the adoption of explicit policies, guidelines, or best practices.
  arXiv  Detail & Related papers  (2023-08-07T23:43:32Z)
• Use case cards: a use case reporting framework inspired by the European AI Act [0.0]
  We propose a new framework for the documentation of use cases, that we call "use case cards" Unlike other documentation methodologies, we focus on the purpose and operational use of an AI system. The proposed framework is the result of a co-design process involving a relevant team of EU policy experts and scientists.
  arXiv  Detail & Related papers  (2023-06-23T15:47:19Z)
• Collective Knowledge: organizing research projects as a database of reusable components and portable workflows with common APIs [0.2538209532048866]
  This article provides the motivation and overview of the Collective Knowledge framework (CK or cKnowledge) The CK concept is to decompose research projects into reusable components that encapsulate research artifacts. The long-term goal is to accelerate innovation by connecting researchers and practitioners to share and reuse all their knowledge.
  arXiv  Detail & Related papers  (2020-11-02T17:42:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.