CoChat
Sign Up
Cited by 5Software Engineering Techniques and PracticesSoftware Engineering ResearchSoftware System Performance and Reliability

An empirical study of policy as code: adoption, purpose, and maintenance

Open access
Opdebeeck, Ruben, Alfadel, Mahmoud, Rahman, Akond, Kashiwa, Yutaro, Ferreira, João F., Kula, Raula Gaikovina, De Roover, Coen·2026·Proceedings of the 23rd International Conference on Mining Software Repositories
DOI 10.1145/3793302.3793355
Open this paper in CoChat — free account

Abstract

Policy as Code (PaC) is an emerging DevOps practice that enables teams to specify organisational and technical policies, such as regulatory compliance, security requirements, and resource limits, through machine-enforceable declarative code. As PaC gains prominence, practitioners face difficulties in adopting PaC while there remains a limited empirical understanding of how these policies are introduced, what types can be expressed, and how they are maintained in practice.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3793302.3793355

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • In operations, knowing when to stop is part of the safety case.

    “In operations, knowing when to stop is part of the safety case [84], [85], [71].”

    From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [84]

    Section 2 (p. 2) describes a policy that denies a request from an untrusted container source and aborts deployment when the policy is violated. That supports the idea of a defined stopping condition, but the paper does not frame such conditions as part of an operational safety case. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

  • Modern production diagnosis is fundamentally query-driven, and good teams treat incident response as repeated hypothesis testing under partial observability.

    “First, modern production diagnosis is fundamentally query-driven, and good teams treat incident response as repeated hypothesis testing under partial observability [4], [78], [84].”

    From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [84]

    Section 4.1 (p. 6) discusses how policy-as-code checks are triggered, while Section 5.2 (p. 10) discusses limits of the study’s repository analysis. Neither addresses query-driven production diagnosis or incident response as repeated hypothesis testing under partial observability; searches for those concepts found no relevant passage in our copy. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

  • Empirical studies show that coordination and information foraging dominate real incident work.

    “Empirical studies show that coordination and information foraging dominate real incident work [84]”

    From Large language models for agentic NetOps and AIOps: Architectures, evaluation, and safety (2027) · cites this paper as [84]

    The Empirical Study (p. 5) examines adoption, purpose, and maintenance of policy-as-code files, not incident work. The Related Work section (p. 11) likewise does not address whether coordination and information foraging dominate incidents. Searches for the quoted phrase and for incident-response coordination and information gathering found no supporting passage in our copy. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 81

  1. [1][1] Amritanshu Agrawal, Akond Rahman, Rahul Krishna, Alexander Sobran, and Tim Menzies. 2018. We don't need another hero? the impact of "heroes" on software development. In Proceedings of the 40th International Conference on Software Engineering: Software Engineering in Practice . ACM, 245-253. doi:10. 1145/3183519.3183549 -
  2. [2][2] Ahmad Alnafessah, Alim Ul Gias, Runan Wang, Lulai Zhu, Giuliano Casale, and Antonio Filieri. 2021. Quality-Aware DevOps Research: Where Do We Stand? IEEE Access 9 (2021), 44476-44489. doi:10.1109/ACCESS.2021.3064867 - · DOI
  3. [3][3] Benjamin Andow, Samin Yaseer Mahmud, Wenyu Wang, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Tao Xie. 2019. PolicyLint: investigating internal privacy policy contradictions on google play. In 28th USENIX security symposium (USENIX security 19) . 585-602. -
  4. [4][4] Benjamin Andow, Samin Yaseer Mahmud, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Serge Egelman. 2020. Actions speak louder than words: Entity-Sensitive privacy policy and data flow analysis with PoliCheck. In 29th USENIX Security Symposium (USENIX Security 20) . 985-1002. -
  5. [5][5] Kathy Charmaz. 2014. Constructing grounded theory (2nd ed.). Sage. -
  6. [6][6] Michele Chiari, Michele De Pascalis, and Matteo Pradella. 2022. Static Analysis of Infrastructure as Code: a Survey. In 2022 IEEE 19th International Conference on Software Architecture Companion (ICSA-C) . 218-225. doi:10.1109/ICSA-C54293. 2022.00049 - · DOI
  7. [7][7] William Gemmell Cochran. 1977. Sampling Techniques (3rd ed.). John Wiley & Sons. -
  8. [8][8] Jacob Cohen. 1960. A Coefficient of Agreement for Nominal Scales. Educational and Psychological Measurement 20, 1 (1960), 37-46. doi:10.1177/ 001316446002000104 -
  9. [9][9] Ting Dai, Alexei Karve, Grzegorz Koper, and Sai Zeng. 2020. Automatically Detecting Risky Scripts in Infrastructure Code. In Proceedings of the 11th ACM Symposium on Cloud Computing . ACM, 358-371. doi:10.1145/3419111.3421303 - · DOI
  10. [10][10] Stefano Dalla Palma, Dario Di Nucci, Fabio Palomba, and Damian Andrew Tamburri. 2020. Toward a catalog of software quality metrics for infrastructure code. Journal of Systems and Software 170 (2020), 110726. -
  11. [11][11] Stefano Dalla Palma, Dario Di Nucci, Fabio Palomba, and Damian A. Tamburri. 2022. Within-Project Defect Prediction of Infrastructure-as-Code Using Product and Process Metrics. IEEE Transactions on Software Engineering 48, 6 (2022), 2086-2104. doi:10.1109/TSE.2021.3051492 - · DOI
  12. [12][12] Stefano Dalla Palma, Chiel van Asseldonk, Gemma Catolino, Dario Di Nucci, Fabio Palomba, and Damian A Tamburri. 2023. 'Through the looking-glass..." An Empirical Study on Blob Infrastructure Blueprints in TOSCA. Journal of Software: Evolution and Process (2023). -
  13. [13][13] Fred D Davis, RP Bagozzi, and PR Warshaw. 1989. Technology acceptance model. J Manag Sci 35, 8 (1989), 982-1003. -
  14. [14][14] Feng Dong, Haoyu Wang, Li Li, Yao Guo, Guoai Xu, and Shaodong Zhang. 2018. How do mobile apps violate the behavioral policy of advertisement libraries?. In Proceedings of the 19th International Workshop on Mobile Computing Systems & Applications . 75-80. -
  15. [15][15] Daniel J. Dougherty, Kathi Fisler, and Shriram Krishnamurthi. 2006. Specifying and Reasoning About Dynamic Access-Control Policies. In Automated Reasoning . Springer, 632-646. -
  16. [16][16] Georgios-Petros Drosos, Thodoris Sotiropoulos, Georgios Alexopoulos, Dimitris Mitropoulos, and Zhendong Su. 2024. When Your Infrastructure Is a Buggy Program: Understanding Faults in Infrastructure as Code Ecosystems. Proc. ACM Program. Lang. 8, OOPSLA2, Article 359 (Oct. 2024), 31 pages. doi:10.1145/3689799 - · DOI
  17. [17][17] William Eiers, Ganesh Sankaran, and Tevfik Bultan. 2023. Quantitative Policy Repair for Access Control on the Cloud. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis . ACM, 564-575. doi:10. 1145/3597926.3598078 -
  18. [18][18] William Eiers, Ganesh Sankaran, Albert Li, Emily O'Mahony, Benjamin Prince, and Tevfik Bultan. 2022. Quantifying permissiveness of access control policies. In Proceedings of the 44th International Conference on Software Engineering . ACM, 1805-1817. doi:10.1145/3510003.3510233 - · DOI
  19. [19][19] F. M. A. Erich, C. Amrit, and M. Daneva. 2017. A qualitative study of DevOps usage in practice. Journal of Software: Evolution and Process 29, 6 (2017), e1885. doi:10.1002/smr.1885 - · DOI
  20. [20][20] Jill J Francis, Marie Johnston, Clare Robertson, Liz Glidewell, Vikki Entwistle, Martin P Eccles, and Jeremy M Grimshaw. 2010. What is an adequate sample size? Operationalising data saturation for theory-based interview studies. Psychology and Health 25, 10 (2010), 1229-1245. -
  21. [21][21] Vahid Garousi, Michael Felderer, and Mika V. Mäntylä. 2019. Guidelines for including grey literature and conducting multivocal literature reviews in software engineering. Information and Software Technology 106 (2019), 101-121. doi:10. 1016/j.infsof.2018.09.006 -
  22. [22][22] Michele Guerriero, Martin Garriga, Damian A. Tamburri, and Fabio Palomba. 2019. Adoption, Support, and Challenges of Infrastructure-as-Code: Insights from Industry. In 2019 IEEE International Conference on Software Maintenance and Evolution (ICSME) . 580-589. doi:10.1109/ICSME.2019.00092 - · DOI
  23. [23][23] Oliver Hanappi, Waldemar Hummer, and Schahram Dustdar. 2016. Asserting Reliable Convergence for Configuration Management Scripts. SIGPLAN Not. 51, 10 (oct 2016), 328-343. doi:10.1145/3022671.2984000 - · DOI
  24. [24][24] Mujtaba Hassan, Muzammil Hussain, Maham Irfan, et al. 2019. A policy recommendations framework to resolve global software development issues. In 2019 International Conference on Innovative Computing (ICIC) . IEEE, 1-10. -
  25. [25][25] Md Mahadi Hassan, John Salvador, Shubhra Kanti Karmaker Santu, and Akond Rahman. 2024. State Reconciliation Defects in Infrastructure as Code. Proc. ACM Softw. Eng. 1, FSE, Article 83 (jul 2024), 24 pages. doi:10.1145/3660790 - · DOI
  26. [26][26] Gary Hickey and Cheryl Kipping. 1996. A multi-stage approach to the coding of data from open-ended questions. Nurse researcher 4, 1 (1996), 81-91. -
  27. [27][27] Waldemar Hummer, Florian Rosenberg, Fábio Oliveira, and Tamar Eilam. 2013. Testing Idempotence for Infrastructure as Code. In Middleware 2013 . Springer, 368-388. -
  28. [28][28] Eirini Kalliamvakou, Georgios Gousios, Kelly Blincoe, Leif Singer, Daniel M. German, and Daniela Damian. 2014. The promises and perils of mining GitHub. In Proceedings of the 11th Working Conference on Mining Software Repositories . ACM, 92-101. doi:10.1145/2597073.2597074 - · DOI
  29. [29][29] Stephen Kaplan, Dylan Bulmer, Avery Gosselin, and Sepideh Ghanavati. 2021. Lattice-based Contextual Integrity Analysis of Social Network Privacy Policies . In 2021 IEEE 29th International Requirements Engineering Conference Workshops (REW) . IEEE, 394-399. doi:10.1109/REW53955.2021.00070 - · DOI
  30. [30][30] Shoma Kokuryo, Masanari Kondo, and Osamu Mizuno. 2020. An Empirical Study of Utilization of Imperative Modules in Ansible. In 2020 IEEE 20th International Conference on Software Quality, Reliability and Security (QRS) . 442-449. doi:10. 1109/QRS51102.2020.00063 -
  31. [31][31] Indika Kumara, Zoe Vasileiou, Georgios Meditskos, Damian A. Tamburri, WillemJan Van Den Heuvel, Anastasios Karakostas, Stefanos Vrochidis, and Ioannis Kompatsiaris. 2020. Towards Semantic Detection of Smells in Cloud Infrastructure Code. In Proceedings of the 10th International Conference on Web Intelligence, Mining and Semantics . ACM, 63-67. doi:10.1145/3405962.3405979 - · DOI
  32. [32][32] J. Richard Landis and Gary G. Koch. 1977. The Measurement of Observer Agreement for Categorical Data. Biometrics 33, 1 (1977), 159-174. -
  33. [33][33] Julien Lepiller, Ruzica Piskac, Martin Schäf, and Mark Santolucito. 2021. Analyzing infrastructure as code to prevent intra-update sniping vulnerabilities. In International Conference on Tools and Algorithms for the Construction and Analysis of Systems . Springer, 105-123. -
  34. [34][34] Wei Li, Borui Yang, Hangyu Ye, Liyao Xiang, Qingxiao Tao, Xinbing Wang, and Chenghu Zhou. 2024. MiniTracker: Large-Scale Sensitive Information Tracking in Mini Apps. IEEE Transactions on Dependable and Secure Computing 21, 4 (2024), 2099-2114. doi:10.1109/TDSC.2023.3299945 - · DOI
  35. [35][35] Song Liao, Christin Wilson, Long Cheng, Hongxin Hu, and Huixing Deng. 2020. Measuring the effectiveness of privacy policies for voice assistant applications. In Proceedings of the 36th Annual Computer Security Applications Conference . 856-869. -
  36. [36][36] Xing Liu, Jiqiang Liu, Sencun Zhu, Wei Wang, and Xiangliang Zhang. 2019. Privacy risk analysis and mitigation of analytics libraries in the android ecosystem. IEEE Transactions on Mobile Computing 19, 5 (2019), 1184-1199. -
  37. [37][37] Kirsti Malterud. 1993. Shared Understanding of the Qualitative Research Process. Guidelines for the Medical Researcher. Family Practice 10, 2 (07 1993), 201-206. doi:10.1093/fampra/10.2.201 - · DOI · Paper page
  38. [38][38] Davood Mazinanian, Ameya Ketkar, Nikolaos Tsantalis, and Danny Dig. 2017. Understanding the use of lambda expressions in Java. Proc. ACM Program. Lang. 1, OOPSLA (2017), 85:1-85:31. doi:10.1145/3133909 - · DOI
  39. [39][39] Alok Mishra and Ziadoon Otaiwi. 2020. DevOps and software quality: A systematic mapping. Computer Science Review 38 (2020), 100308. -
  40. [40][40] Kief Morris. 2016. Infrastructure as Code: Managing Servers in the Cloud (1st ed.). O'Reilly. -
  41. [41][41] Ruben Opdebeeck, Bram Adams, and Coen De Roover. 2025. Analysing Software Supply Chains of Infrastructure as Code: Extraction of Ansible Plugin Dependencies. In IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2025 . IEEE, 181-192. doi:10.1109/SANER64311.2025.00025 - · DOI
  42. [43][43] Ruben Opdebeeck, Valeria Pontillo, Camilo Velázquez-Rodríguez, Wolfgang De Meuter, and Coen De Roover. 2025. Smelling Secrets: Leveraging Machine Learning and Language Models for Sensitive Parameter Detection in Ansible Security Analysis. In 2025 IEEE International Conference on Source Code Analysis & Manipulation (SCAM) . 66-77. doi:10.1109/SCAM67354.2025.00014 - · DOI
  43. [44][44] Ruben Opdebeeck, Ahmed Zerouali, and Coen De Roover. 2022. Smelly Variables in Ansible Infrastructure Code: Detection, Prevalence, and Lifetime. In Proceedings of the 19th International Conference on Mining Software Repositories . ACM, 61-72. doi:10.1145/3524842.3527964 - · DOI
  44. [45][45] Ruben Opdebeeck, Ahmed Zerouali, and Coen De Roover. 2023. Control and Data Flow in Security Smell Detection for Infrastructure as Code: Is It Worth the Effort?. In 2023 IEEE/ACM 20th International Conference on Mining Software Repositories (MSR) . 534-545. doi:10.1109/MSR59073.2023.00079 - · DOI
  45. [46][46] Ruben Opdebeeck, Ahmed Zerouali, Camilo Velázquez-Rodríguez, and Coen De Roover. 2021. On the Practice of Semantic Versioning for Ansible Galaxy Roles: An Empirical Study and a Change Classification Model. J. Syst. Softw. 182, C (dec 2021), 21 pages. doi:10.1016/j.jss.2021.111059 - · DOI
  46. [47][47] Stefano Dalla Palma, Majid Mohammadi, Dario Di Nucci, and Damian A. Tamburri. 2020. Singling the Odd Ones out: A Novelty Detection Approach to Find Defects in Infrastructure-as-Code. In Proceedings of the 4th ACM SIGSOFT International Workshop on Machine-Learning Techniques for Software-Quality Evaluation . ACM, 31-36. doi:10.1145/3416505.3423563 - · DOI
  47. [49][49] Ioannis Paspatis, Aggeliki Tsohou, and Spyros Kokolakis. 2020. AppAware: a policy visualization model for mobile applications. Information & Computer Security 28, 1 (2020), 116-132. -
  48. [50][50] Juanjo Pérez-Sánchez, Saima Rafi, Juan Manuel Carrillo de Gea, Joaquín Nicolás Ros, and José Luis Fernández Alemán. 2025. A theory on human factors in DevOps adoption. Computer Standards and Interfaces 92 (2025), 103907. doi:10. 1016/j.csi.2024.103907 -
  49. [51][51] Giovanni Quattrocchi and Damian Andrew Tamburri. 2022. Predictive maintenance of infrastructure code using 'fluid' datasets: An exploratory study on Ansible defect proneness. Journal of Software: Evolution and Process 34, 11 (2022), e2480. doi:10.1002/smr.2480 - · DOI
  50. [52][52] Akond Rahman, Dibyendu Brinto Bose, Raunak Shakya, and Rahul Pandita. 2023. Come for Syntax, Stay for Speed, Understand Defects: An Empirical Study of Defects in Julia Programs. Empirical Software Engineering 28, 93 (2023), 33. -
  51. [53][53] Akond Rahman, Effat Farhana, Chris Parnin, and Laurie Williams. 2020. Gang of Eight: A Defect Taxonomy for Infrastructure as Code Scripts. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering . ACM, 752-764. doi:10.1145/3377811.3380409 - · DOI
  52. [54][54] Akond Rahman, Rezvan Mahdavi-Hezaveh, and Laurie Williams. 2018. A systematic mapping study of infrastructure as code research. Information and Software Technology (2018). doi:10.1016/j.infsof.2018.12.004 - · DOI
  53. [55][55] Akond Rahman, Chris Parnin, and Laurie Williams. 2019. The seven sins: Security smells in infrastructure as code scripts. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . IEEE, 164-175. -
  54. [56][56] Akond Rahman, Md Rayhanur Rahman, Chris Parnin, and Laurie Williams. 2021. Security Smells in Ansible and Chef Scripts: A Replication Study. ACM Trans. Softw. Eng. Methodol. 30, 1, Article 3 (Jan. 2021), 31 pages. doi:10.1145/3408897 - · DOI · Paper page
  55. [57][57] Akond Rahman, Shazibul Islam Shamim, Dibyendu Brinto Bose, and Rahul Pandita. 2023. Security Misconfigurations in Open Source Kubernetes Manifests: An Empirical Study. ACM Trans. Softw. Eng. Methodol. 32, 4, Article 99 (May 2023), 36 pages. doi:10.1145/3579639 - · DOI
  56. [58][58] Akond Rahman and Laurie Williams. 2018. Characterizing Defective Configuration Scripts Used for Continuous Deployment. In 2018 IEEE 11th International Conference on Software Testing, Verification and Validation (ICST) . 34-45. doi:10.1109/ICST.2018.00014 - · DOI
  57. [59][59] Akond Rahman and Laurie Williams. 2019. Source code properties of defective infrastructure as code scripts. Information and Software Technology 112 (2019), 148 - 163. doi:10.1016/j.infsof.2019.04.013 - · DOI
  58. [60][60] Akond Ashfaque Ur Rahman, Eric Helms, Laurie Williams, and Chris Parnin. 2015. Synthesizing Continuous Deployment Practices Used in Software Development. In 2015 Agile Conference . 1-10. doi:10.1109/Agile.2015.12 - · DOI
  59. [61][61] Akond Ashfaque Ur Rahman and Laurie Williams. 2016. Security practices in DevOps. In Proceedings of the Symposium and Bootcamp on the Science of Security . ACM, 109-111. doi:10.1145/2898375.2898383 - · DOI
  60. [62][62] Akond Ashfaque Ur Rahman and Laurie Williams. 2016. Software security in DevOps: synthesizing practitioners' perceptions and practices. In Proceedings of the International Workshop on Continuous Software Evolution and Delivery . ACM, 70-76. doi:10.1145/2896941.2896946 - · DOI · Paper page
  61. [63][63] Jimmy Ray. 2024. Policy as Code (1st ed.). O'Reilly Media. -
  62. [64][64] Sofia Reis, Rui Abreu, Marcelo d'Amorim, and Daniel Fortunato. 2023. Leveraging Practitioners' Feedback to Improve a Security Linter. In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering . ACM, Article 66, 12 pages. doi:10.1145/3551349.3560419 - · DOI
  63. [66][66] Nuno Saavedra and João F. Ferreira. 2023. GLITCH: Automated Polyglot Security Smell Detection in Infrastructure as Code. In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering . ACM, Article 47, 12 pages. doi:10.1145/3551349.3556945 - · DOI
  64. [67][67] Nuno Saavedra, João Gonçalves, Miguel Henriques, João F. Ferreira, and Alexandra Mendes. 2023. Polyglot code smell detection for infrastructure as code with GLITCH. In 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) . IEEE, 2042-2045. -
  65. [69][69] J. Schwarz, A. Steffens, and H. Lichter. 2018. Code Smells in Infrastructure as Code. In 2018 11th International Conference on the Quality of Information and Communications Technology (QUATIC) . 220-228. doi:10.1109/QUATIC.2018.00040 - · DOI
  66. [70][70] Rian Shambaugh, Aaron Weiss, and Arjun Guha. 2016. Rehearsal: A Configuration Verification Tool for Puppet. In Proceedings of the 37th ACM SIGPLAN Conference on Programming Language Design and Implementation . ACM, 416-430. doi:10. 1145/2908080.2908083 -
  67. [71][71] Tushar Sharma, Marios Fragkoulis, and Diomidis Spinellis. 2016. Does Your Configuration Code Smell?. In Proceedings of the 13th International Conference on Mining Software Repositories . ACM, 189-200. doi:10.1145/2901739.2901761 - · DOI
  68. [72][72] Parvaneh Shayegh, Vijayanta Jain, Amin Rabinia, and Sepideh Ghanavati. 2019. Automated approach to improve iot privacy policies. arXiv preprint arXiv:1910.04133 (2019). - · arXiv
  69. [73][73] Rocky Slavin, Xiaoyin Wang, Mitra Bokaei Hosseini, James Hester, Ram Krishnan, Jaspreet Bhatia, Travis D. Breaux, and Jianwei Niu. 2016. Toward a framework for detecting privacy policy violations in android application code. In Proceedings of the 38th International Conference on Software Engineering . ACM, 25-36. doi:10. 1145/2884781.2884855 -
  70. [75][75] Daniel Sokolowski, David Spielmann, and Guido Salvaneschi. 2024. The PIPr Dataset of Public Infrastructure as Code Programs. In Proceedings of the 21st International Conference on Mining Software Repositories . ACM, 498-503. doi:10. 1145/3643991.3644888 -
  71. [76][76] Thodoris Sotiropoulos, Dimitris Mitropoulos, and Diomidis Spinellis. 2020. Practical Fault Detection in Puppet Programs. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering . ACM, 26-37. doi:10.1145/ 3377811.3380384 -
  72. [78][78] Angela Sweeney, Kathryn E Greenwood, Sally Williams, Til Wykes, and Diana S Rose. 2013. Hearing the voices of service user researchers in collaborative qualitative data analysis: the case for multiple coding. Health Expectations 16, 4 (2013), e89-e99. -
  73. [79][79] António Trigo, João Varajão, and Leandro Sousa. 2022. DevOps adoption: Insights from a large European Telco. Cogent Engineering 9, 1 (2022), 2083474. -
  74. [80][80] Eduard van der Bent, Jurriaan Hage, Joost Visser, and Georgios Gousios. 2018. Howgood is your puppet? An empirically defined and validated quality model for puppet. In 2018 IEEE 25th International Conference on Software Analysis, Evolution and Reengineering (SANER) . 164-174. doi:10.1109/SANER.2018.8330206 - · DOI
  75. [81][81] Alexandre Verdet, Mohammad Hamdaqa, Leuson Da Silva, and Foutse Khomh. 2025. Assessing the adoption of security policies by developers in terraform across different cloud providers. Empirical Software Engineering 30, 3 (2025), 74. -
  76. [82][82] Denis Verdon. 2006. Security policies and the software developer. IEEE Security & Privacy 4, 4 (2006), 42-49. -
  77. [83][83] Xiaoyin Wang, Xue Qin, Mitra Bokaei Hosseini, Rocky Slavin, Travis D Breaux, and Jianwei Niu. 2018. Guileak: Tracing privacy policy claims on user input data for android applications. In Proceedings of the 40th International Conference on Software Engineering . 37-47. -
  78. [84][84] Fuman Xie, Yanjun Zhang, Chuan Yan, Suwan Li, Lei Bu, Kai Chen, Zi Huang, and Guangdong Bai. 2022. Scrutinizing privacy policy compliance of virtual personal assistant apps. In Proceedings of the 37th IEEE/ACM international conference on automated software engineering . 1-13. -
  79. [85][85] Yue Zhang, Muktadir Rahman, Fan Wu, and Akond Rahman. 2023. Quality Assurance for Infrastructure Orchestrators: Emerging Results from Ansible. In 2023 IEEE 20th International Conference on Software Architecture Companion (ICSA-C) . 1-3. doi:10.1109/ICSA-C57050.2023.00073 - · DOI
  80. [86][86] Sebastian Zimmeck, Rafael Goldstein, and David Baraka. 2021. PrivacyFlash Pro: Automating Privacy Policy Generation for Mobile Apps.. In 28th Annual Network and Distributed System Security Symposium, NDSS . 18. -
  81. [87][87] Sebastian Zimmeck, Peter Story, Daniel Smullen, Abhilasha Ravichander, Ziqi Wang, Joel Reidenberg, N Cameron Russell, and Norman Sadeh. 2019. Maps: Scaling privacy compliance analysis to a million apps. Proceedings on Privacy Enhancing Technologies (2019).

Cited by

Sorted by citations

Authors
Opdebeeck, R., Alfadel, M., Rahman, A., Kashiwa, Y., Ferreira, J. F., Kula, R. G., & De Roover, C.
Affiliations
  • Vrije Universiteit Brussel (BE)
  • University of Calgary (CA)
  • Auburn University (US)
  • Nara Institute of Science and Technology (JP)
  • Instituto de Engenharia de Sistemas e Computadores Investigação e Desenvolvimento (PT)
  • The University of Osaka (JP)
  • Vrije Universiteit Brussel, Brussels, Belgium
ORCID
Venue
Proceedings of the 23rd International Conference on Mining Software Repositories
Publisher
ACM
Published
2026-04-13
Pages
249-261
DOI
10.1145/3793302.3793355
OpenAlex
W7171986568
Cited by
5
References
3
Citations by year
2026: 5
FWCI
53.41
Type
conference paper
Language
en
Open access
Licence
Locations
  • International Conference on Mining Software Repositories (MSR) (publishedVersion, cc-by)
  • VUBIR (Vrije Universiteit Brussel) (submittedVersion)
Funders
  • Vlaamse Overheid (Cybersecurity Research Program Flanders)
  • National Science Foundation (2312321)
  • Natural Sciences and Engineering Research Council of Canada (N/A)
  • Fundação para a Ciência e a Tecnologia (UID/50021/2025, UID/PRR/50021/2025)
  • Plano de Recuperação e Resiliência (2024.07411.IACDC)
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
Keywords
policy-as-code, DevOps, regulatory compliance, security requirements, resource constraints, policy adoption, policy maintenance

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review