Current model has no Policy/Compliance/Governance module

[kurktchiev]

One of the core components of any platform is ultimately answering: how does any/all of this fit into an organization's overall security posture. Especially these days with everyone marching, in some way shape or form, towards ZTA, I think having the built in tooling to help enable that and even better accelerate it, is extremely important.

As the current model stands it does not incorporate any tooling around this. I believe there should be some thinking put into what should be added in. From the CNCF side OPA and Kyverno are in play. Both have their merits and shortcomings, however, I think it would benefit the project and the overall movement if there is some discussion on the topic. Being able to say things like: you get NIST 800-53 out of the box, or PCI, or insert any of the industry standards we all have to one way or another find a way to adhere to, is going to be just as important as being able to spin up a platform I can build on top of.