policy-driven automation in CI/CD