Compliance-as-Code: Automating Evidence Collection with Human-in-the-Loop Review

Security and compliance frameworks generally require proof that a control functions continuously, not that it was configured correctly once. Most organizations still produce that proof by hand - a captured screenshot, a spreadsheet entry, a forwarded confirmation email - a method built for a slower era of infrastructure change and poorly suited to systems provisioned, modified, and redeployed through code on a near-continuous basis. This article examines an architectural alternative: embedding evidence generation directly into the internal developer platform that already governs provisioning and deployment, so a control's operating state is captured as a byproduct of normal platform activity rather than reconstructed after the fact for an auditor. Written from a platform-engineering vantage point - grounded in experience building golden-path developer tooling and platform-embedded policy enforcement - rather than from compliance practice, its central claim is narrower than "automate compliance": evidence gathering belongs at the platform layer, but the determination that gathered evidence actually satisfies a control's intent should remain a deliberately structured human decision. Recent empirical work on infrastructure-as-code security posture and pipeline misconfiguration rates supports continuous, machine-gathered evidence over periodic manual sampling; separate research on human oversight of automated recommendations complicates the assumption that adding a human reviewer automatically improves decision quality, and that complication shapes how the review layer proposed here is designed. The article closes by considering what it takes, organizationally, to move a compliance function that has long operated on manual habit toward this platform-centered model.