examples/policies/ has a starting-point policy for nine sectors —
devops, payments, e-commerce, insurance, healthcare, legal, security, government, hr. Each is
headed "Starting point on the v0.1 kernel. Adapt before use." and each was written by someone
who is not a practitioner in that sector.
If you work in one of these domains, the useful contribution is telling us where the template
is wrong. No code required; a comment is a complete contribution.
The three questions
- What consequential action is missing? Something an agent in your domain would plausibly
do that the template has no entry for.
- What threshold is wrong? An amount, a count, a window that would either wave through
something serious or stop routine work dead. The second failure mode is the one that gets a
guard switched off.
- What would this refuse that it should not? A template that blocks ordinary work is a
template nobody keeps.
Rules for a change to one
- v0.1 primitives only. These are starting points, not a product surface.
- No compliance or standards claims. Not in the YAML, not in a comment, not in the PR
description — not "PCI", not "HIPAA-aligned", not "meets". This is enforced by a lint and by
the project's standards rule: integrate first, map second, never claim compliance. A template
that names a regulation as its authority is the one thing that will not be merged.
- Cite where an expectation comes from if it has a public source, as a fact about the source
and not as a claim about the file.
The deeper sector packs — control registries, approver roles, data scope — are a separate track
that runs on the v0.6 primitives and is authored and reviewed in a documented way. This issue is
only about the templates that ship today.
examples/policies/has a starting-point policy for nine sectors —devops, payments, e-commerce, insurance, healthcare, legal, security, government, hr. Each is
headed "Starting point on the v0.1 kernel. Adapt before use." and each was written by someone
who is not a practitioner in that sector.
If you work in one of these domains, the useful contribution is telling us where the template
is wrong. No code required; a comment is a complete contribution.
The three questions
do that the template has no entry for.
something serious or stop routine work dead. The second failure mode is the one that gets a
guard switched off.
template nobody keeps.
Rules for a change to one
description — not "PCI", not "HIPAA-aligned", not "meets". This is enforced by a lint and by
the project's standards rule: integrate first, map second, never claim compliance. A template
that names a regulation as its authority is the one thing that will not be merged.
and not as a claim about the file.
The deeper sector packs — control registries, approver roles, data scope — are a separate track
that runs on the v0.6 primitives and is authored and reviewed in a documented way. This issue is
only about the templates that ship today.