Many companies are talking about the "shift left" approach where many of the requirements and testing are pulled away from operations (so called; right) and brought to the left (requirements, source code). While there are a lot of "as code" possibilities; ATTD, Infrastructure as code, configuration as code and of source source code ;), one can also start to think about risk as code, security controls as code, policy as code, AI as code, architecture as code. So what happens if you do that in a company. What things change and what remains the same.