research(policyAsCode): Language/Tooling

[drochow]

Task Description

As we start working on the first policy violations, we need to make some decisions about preferred Policy As Code tooling.

• Do we want a central PaC approach?
• Is the policy executed by the scanner or by Heureka?
• If the scanners should take care of that, do we need unified tooling, or should that be scanner-dependent?
• Do you know what Tooling we would like to use for this purpose? (e.g., rego)

Acceptance Criteria:

• Questions answered
• ADR created

[lolaapenna]

Deferred to the BL.