Policies

A policy is a YAML file. Two packs ship with the package as working examples: popia_hr_v1 and popia_customer_v1. They are examples of how the engine expresses purpose, consent and legal basis. They are not legal advice, so have your own counsel review any policy before you rely on it.

A policy

name: popia_hr
default_decision: deny          # nothing is released unless granted and guarded
require_legal_basis: true
require_known_purpose: true     # an undefined purpose is denied (the default)

purposes:
  employee_directory_lookup:
    necessary_fields: [name, email, department, job_title]   # data minimisation

fields:
  salary:
    sensitivity: high
    never_external: true        # whatever a rule says, this never leaves
    no_persistence: true        # and never becomes agent memory

rules:
  - id: directory-contact-fields
    match: { purpose: employee_directory_lookup }
    field: [name, email, department, job_title]
    decision: allow
    reason: contact details are necessary for a directory lookup

Top level

Purposes

purposes:
  monthly_payroll_processing:
    description: Running the monthly payroll.
    necessary_fields: [name, employee_id, bank_account, salary, tax_number]
    compatible_with: []

necessary_fields drives the purpose-necessity guard: a requested field outside the list is denied. A purpose that is not defined under purposes is denied while require_known_purpose is true, which it is by default. A defined purpose that lists no fields is not constrained by this guard. compatible_with names purposes this one is a compatible secondary use of; the consent guard accepts consent given for a compatible purpose.

Fields

Rules

rules:
  - id: payroll-agent-remuneration
    match:
      agent: payroll_agent
      principal_role: hr_payroll_admin
      purpose: monthly_payroll_processing
      destination: internal_system
    field: [salary, bank_account, tax_number, name, employee_id]
    decision: allow
    reason: payroll administration requires remuneration data

• match keys can be agent, principal, principal_role, purpose, task, tool, resource, destination, jurisdiction and retention. A value can be a single value, a list, or *. An unknown key never matches.
• field is a field name, a list of names, or *.
• decision is any decision from Concepts, or one of these shorthands that adds obligations: allow_ephemerally, log_and_allow, log_and_block, do_not_store, do_not_send_externally, delete_after_task.
• Specificity. Rules that constrain more of the context win; ties go to the rule declared first.

Your own packs

A deployment's policy: can be:

1. a file path, such as ./policies/my_bank_v1.yaml, resolved next to the deployment file first;
2. a bare name found in the directories listed in MORITI_POLICY_PATH, separated like PATH;
3. the name of a bundled pack.

Your packs win over bundled ones. Copying popia_hr_v1.yaml into your own directory and editing it is the whole workflow. Nothing touches the installed package.

The deployment file

The same file configures the proxy, the ContextForge plugin, the ADK plugin and the HTTP service.