[Verse 1]
Rego looks like readable code at first glance
But compliance folks need more than a fleeting chance
A lawyer can't decode what allow and deny mean
The gap between syntax and policy's wide and keen
Training required to bridge that divide
While technical minds find it easy to ride
[Chorus]
Three weaknesses holding Rego back
Human readability it will always lack
Limited scope leaves gaps in the track
Binary thinking when nuance we need to pack
Rego's got limits we can't ignore
These three walls we keep hitting more and more
[Verse 2]
Technical controls and operational too
But administrative rules slip right through
No training requirements or governance frames
Physical controls aren't part of its games
Badge access and cameras stay outside
Human judgment has nowhere to hide
[Chorus]
Three weaknesses holding Rego back
Human readability it will always lack
Limited scope leaves gaps in the track
Binary thinking when nuance we need to pack
Rego's got limits we can't ignore
These three walls we keep hitting more and more
[Bridge]
Should and may get lost in translation
Obligation needs clear articulation
Shall versus recommended disappears
In binary land where everything's clear
Allow or deny but nothing between
The deontic subtlety can't be seen
[Verse 3]
JSON input is all it can read
Structured data is all that it needs
Unstructured context gets left behind
Qualified professionals lost in the grind
Documentation generation's not there
Manual traceability shows the wear
[Chorus]
Three weaknesses holding Rego back
Human readability it will always lack
Limited scope leaves gaps in the track
Binary thinking when nuance we need to pack
Rego's got limits we can't ignore
These three walls we keep hitting more and more
[Outro]
Code repositories hold the rules
But compliance teams need different tools
The bridge between policy and automation
Needs more than Rego's implementation