PolicyPatcher

PolicyPatcher is a web app (with optional CLI) that continuously checks your Kubernetes, Terraform, and cloud IAM policies against a curated ruleset and your own internal standards, then proposes safe, reviewable patches. It focuses on the boring but costly failures: overly-permissive roles, drifted Terraform modules, mis-scoped network policies, and “temporary” exceptions that never expire. The product runs in read-only mode by default, generating pull requests with minimal diffs and clear blast-radius notes. It also tracks policy ownership, expiry dates for exceptions, and change history so teams can prove compliance without spreadsheet archaeology. This is a combination traditional + AI app: traditional for deterministic checks and PR automation, AI only for explaining findings, summarizing risk, and drafting human-readable remediation notes (not for making unreviewed changes). Expect pushback: security and platform teams are skeptical of new tooling, so it must be low-friction and auditable.