Legal, Risk & Compliance · Module
Policy-as-Code
Written policies turned into tested, versioned rules the platform enforces and logs
Policy-as-Code turns policies such as delegation of authority, data handling and agent behaviour into versioned, tested policy bundles. The platform enforces them and logs every decision.
What it does
Policy-as-Code is designed to close the gap between policy text and system behaviour. Written policies (delegation of authority, data handling, agent behaviour, approvals, access, retention) become versioned, tested policy bundles that the platform enforces through Admin & Policy and the Action Bus, with every evaluation logged.
Authoring
A bundle carries rules, an input schema, a scope (apps, Actions, entities, agents), an owner and a linked policy document. The structured rule editor sets conditions on actor, Action, risk tier, amount, data classification, time and location, and compiles them to the platform policy format. AI can draft rules and test cases from a policy paragraph, showing which source sentence each rule comes from and asking about ambiguities; every rule needs human confirmation.
Testing and deployment
Policy tests define inputs and expected allow, deny or approval outcomes, and regression suites must pass before approval. Blast-radius analysis replays recent Action log entries against the new version and shows which decisions would change, by app and actor. Deployment moves from draft to tested to approved (owner plus a second approver) to staged in shadow to enforced, with rollback to the prior version.
Decisions and exceptions
The decision log records each evaluation's input hash, version, result and reason, with sampled storage for high-volume allow decisions. Exceptions are time-boxed with justification, approver and compensating controls, and expire automatically.
GA
In W4, shadow mode diff reports, conflict detection across bundles, policy-to-document linkage with attestation campaigns, agent policy packs for spend, channels, data classes and disclosure, and policy decisions used as automated GRC evidence are planned. The AI Policy Writer drafts rules, compares versions and prepares attestation campaigns. Planned for W3 (Year 2).
Features
What Policy-as-Code includes
Policy bundles
Versioned rules with input schema, scope across apps, Actions, entities and agents, owner and linked document.
Structured rule authoring
Conditions on actor, Action, risk tier, amount, data classification, time and location.
Plain language to policy draft
AI drafts rules and tests from a policy paragraph with source-sentence mapping.
Policy tests
Unit cases and regression suites that must pass before approval.
Blast-radius analysis
Replays recent Action log entries against the candidate version to show changed decisions.
Approval and staged deployment
Owner and second approver, shadow staging, enforcement and rollback.
Decision log
Input hash, version, result and reason for every evaluation, queryable.
Time-boxed exceptions
Justification, approver, compensating controls and auto-expiry.
Shadow mode and conflict detection
Evaluate without enforcing with diff reports; detect overlapping or contradictory rules with precedence explanation (W4).
Agent policy packs
Spend, channel, data class and disclosure policies for Digital Employees aligned with AI Governance (W4).
Policy as evidence and attestations
GRC controls reference bundles and decision-log queries; attestation campaigns to employees (W4).
Workflow
Policy change
- 1
A policy paragraph is drafted into rules and tests
- 2
Each rule is confirmed by a person
- 3
Tests and regression suites run
- 4
Blast-radius replay shows changed decisions
- 5
Owner and second approver approve
- 6
The bundle runs in shadow, then is enforced, with rollback available
AI
AI skills and Digital Employees
Plain language to rules
Draft rules and test cases with source mapping and ambiguity questions.
Version comparison narrative
Explains blast-radius results computed by deterministic replay.
Attestation campaign drafts
Employee policy summaries and campaign drafts for human launch.
Conflict explanation
Explains overlapping rules found by deterministic detection.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Does AI write enforceable policy on its own?
No. AI drafts rules, but each rule needs human confirmation, tests must pass and two approvers sign off before enforcement.
Can we test a change before enforcing it?
Yes. Blast-radius replay and shadow mode show which decisions would change before a bundle is enforced.
Which policy engine format is used?
The platform policy format is still being decided in an architecture record; rules compile to it.
See Policy-as-Code in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.