--- title: Guardrails, not gates: rethinking policy in platform teams description: A platform engineering essay argues that most Kubernetes policy systems built with tools like Kyverno and Gatekeeper function as gates (closed-by-default,... canonical: https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Guardrails, not gates: rethinking policy in platform teams | daily.dev og:description: A platform engineering essay argues that most Kubernetes policy systems built with tools like Kyverno and Gatekeeper function as gates (closed-by-default,... og:url: https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18 og:image: https://api.daily.dev/og/posts/29yyf9e18.png og:image:alt: Guardrails, not gates: rethinking policy in platform teams og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Guardrails, not gates: rethinking policy in platform teams **[CNCF](https://daily.dev/sources/cncf)** · 8 min read · 1 upvotes · 0 comments ## Summary A platform engineering essay argues that most Kubernetes policy systems built with tools like Kyverno and Gatekeeper function as gates (closed-by-default, blocking) rather than guardrails (correcting while allowing flow), and that this mental model, not tooling, drives developer resentment and shadow infrastructure. The piece breaks policy into four jobs—validate, mutate, generate, verify—and observes that most teams overweight validation (gate behavior) while underusing mutation and generation (guardrail behavior) which silently fix or scaffold configurations. It also argues policy ownership should shift from security to platform teams, with policies treated as versioned products with rollout plans, and offers a diagnostic for readers to classify their own platform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the four jobs a modern Kubernetes policy engine like Kyverno can perform? A modern policy engine performs four jobs: validate, mutate, generate, and verify. Validation blocks or allows based on rules, mutation automatically fixes or adds missing configuration (like security context defaults or image mirror rewrites), generation scaffolds new resources such as NetworkPolicy or ResourceQuota when a namespace is created, and verification checks image signatures and provenance at trust boundaries. _Platform teams weighing how to structure Kyverno policies can find practical breakdowns like this on daily.dev._ ### Why do developers end up resenting platform teams that enforce Kubernetes policies? Resentment builds when policy setups are designed around denying rather than helping, making every developer interaction with policy a source of friction. Blocked deployments without clear explanations pile up as tickets, the platform team becomes an appeals court granting exceptions, and developers start routing around the platform via shadow infrastructure, stalling adoption instead of removing bottlenecks. _Anyone balancing security requirements against developer experience on Kubernetes platforms can track this debate on daily.dev._ ## Similar posts on daily.dev - [Guardrails for AI-Generated Infrastructure](https://daily.dev/posts/guardrails-for-ai-generated-infrastructure-1vyxzsevf) · Spacelift · 0 upvotes · 0 comments - [Validating, scoring, and gating Kubernetes configuration after every change](https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm) · ITNEXT · 0 upvotes · 0 comments - [Kyverno is a platform primitive, not a security tool](https://daily.dev/posts/kyverno-is-a-platform-primitive-not-a-security-tool-ljkednzl9) · CNCF · 15 upvotes · 2 comments - [How To Spend More Time On Platform Development & Less On Dev Support](https://daily.dev/posts/how-to-spend-more-time-on-platform-development-less-on-dev-support-pzgk8mefv) · Fairwinds Blog · 2 upvotes · 1 comments - [Inside Platform Engineering with Kian Rogerdi](https://daily.dev/posts/inside-platform-engineering-with-kian-rogerdi-rqfdftony) · OctopusDeploy · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#platform-engineering](https://daily.dev/tags/platform-engineering), [#policy-as-code](https://daily.dev/tags/policy-as-code), [#kyverno](https://daily.dev/tags/kyverno) [View this post on daily.dev](https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Guardrails, not gates: rethinking policy in platform teams","url":"https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18"},"datePublished":"2026-10-01T11:30:55.241Z","dateModified":"2026-10-01T11:31:16.119Z","description":"A platform engineering essay argues that most Kubernetes policy systems built with tools like Kyverno and Gatekeeper function as gates (closed-by-default,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b4a9ae021ce7f69c3ed41616414875c4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b4a9ae021ce7f69c3ed41616414875c4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CNCF","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CNCF","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/55536a03390741eebd96d2f9b74d2d8d","url":"https://daily.dev/sources/cncf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,platform-engineering,policy-as-code,kyverno","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CNCF","item":"https://daily.dev/sources/cncf"},{"@type":"ListItem","position":3,"name":"Guardrails, not gates: rethinking policy in platform teams"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18#faq","mainEntity":[{"@type":"Question","name":"What are the four jobs a modern Kubernetes policy engine like Kyverno can perform?","acceptedAnswer":{"@type":"Answer","text":"A modern policy engine performs four jobs: validate, mutate, generate, and verify. Validation blocks or allows based on rules, mutation automatically fixes or adds missing configuration (like security context defaults or image mirror rewrites), generation scaffolds new resources such as NetworkPolicy or ResourceQuota when a namespace is created, and verification checks image signatures and provenance at trust boundaries. Platform teams weighing how to structure Kyverno policies can find practical breakdowns like this on daily.dev."}},{"@type":"Question","name":"Why do developers end up resenting platform teams that enforce Kubernetes policies?","acceptedAnswer":{"@type":"Answer","text":"Resentment builds when policy setups are designed around denying rather than helping, making every developer interaction with policy a source of friction. Blocked deployments without clear explanations pile up as tickets, the platform team becomes an appeals court granting exceptions, and developers start routing around the platform via shadow infrastructure, stalling adoption instead of removing bottlenecks. Anyone balancing security requirements against developer experience on Kubernetes platforms can track this debate on daily.dev."}}]} ```