apply.Govern Terraform, Dockerfiles, Kubernetes manifests and CloudFormation with the same policy engine and evidence trail as your application code, caught in the IDE and at the PR gate, not in a post-deploy scan.
The problem. AI now writes infrastructure as readily as application code, and a single generated Terraform block can open a public bucket, drop an over-broad IAM policy, or ship a root container. By the time a cloud scanner flags it, it's already deployed.
Policy violations in IaC surface in the IDE and block at the PR gate, before infrastructure is provisioned, not after.
Public exposure, weak crypto, over-privileged roles, missing encryption, and root containers, all mapped to CIS Benchmarks and your frameworks.
The control you set for app code applies to the infrastructure that runs it: one policy set, one assessment, one evidence trail.
Encode your organization's IaC standards as policy-as-code that travels with the repository and enforces automatically.
Coverage: Terraform · Dockerfile · Kubernetes manifests · CloudFormation