Exercise 3: Why Automated Policy Enforcement Catches What a Checklist-Based Review Might Miss — Possible Solution
====================================================================

A manual code-review checklist depends entirely on a HUMAN remembering
to check for the specific issue, every single time, across every
single PR -- and consistently applying that check correctly even under
time pressure, reviewer fatigue, or simple oversight on a large diff.
"No public S3 buckets" as a checklist item only works if the reviewer
actually notices the relevant resource block buried in a larger
change, correctly reasons through whatever access-control arguments
are set, and remembers to flag it -- none of which is guaranteed to
happen every time, especially as the team and the number of PRs grow.

Policy as code (Sentinel/OPA) removes the human-consistency dependency
entirely: the rule "no public S3 buckets" is written once, as
executable logic, and then runs AUTOMATICALLY against every single
plan, with no reliance on any individual remembering to look. It
doesn't get tired, doesn't skim a large diff, and doesn't have an
off day -- the same check runs with identical rigor on PR #1 and PR
#10,000. A plan that would create a public bucket simply fails the
policy check and is blocked from being applied at all, regardless of
whether a human reviewer happened to notice it during review.

This isn't a claim that automated policy makes human review
unnecessary -- the chapter's own tip-box states the human review of
the posted plan remains the most valuable checkpoint for catching
"that's not what I meant." The two aren't redundant: policy as code
reliably catches well-defined, rule-based violations (public buckets,
missing encryption) with perfect consistency, while human review
catches genuinely judgment-based mistakes that can't be reduced to a
simple rule. Automated enforcement's real advantage is specifically
CONSISTENCY at scale for exactly the kind of check a checklist depends
on a person remembering -- not broader judgment than a human reviewer
has.

WHY THIS WORKS AS AN ANSWER
------------------------------
This identifies the specific failure mode of checklist-based review
(dependent on human consistency, which degrades at scale/under
pressure) that automated policy structurally removes, while explicitly
avoiding overclaiming that automation replaces human review entirely --
consistent with the chapter's own framing of both as complementary.