A central security team cannot manually review every commit once an organization has hundreds of engineers — a human reviewer needs real time to read a diff, so manual review throughput is capped by headcount, no matter how many teams are committing. Policy-as-code (the pattern behind tools like Open Policy Agent) expresses the same rules — "no root containers", "buckets must be encrypted" — as machine-readable, declarative policy that a rules engine evaluates automatically against every commit from every team, in parallel.
This simulator runs both models side by side conceptually: toggle the switch to send commits either straight into the parallel policy engine, or into a single reviewer queue. Watch the backlog stat — with policy-as-code it stays near zero because throughput scales with compute; with manual review it grows without bound the moment the arrival rate exceeds one reviewer's fixed processing rate, exactly the bottleneck that motivates automating security gates at scale.
manual throughput = 1 reviewer × (1 / review_time) → constant
policy-as-code = f(compute) → scales with teams
- Policy-as-code ON — every commit is evaluated independently and near-instantly; backlog stays flat even at 40+ teams.
- Manual review (toggle off) — one reviewer node processes commits one at a time; raise the team count or commit rate and the queue climbs continuously.