Compliance as Code: Policy Governed Automated Security Checkpoints