Skip to main content

Compliance policy configuration

This page gives the correct YAML structures and the operation of each compliance policy.

GDPR compliance​

gdpr-compliance is an input-phase policy. The runtime reads these fields from policy.gdpr-compliance:

policies:
  chain:
    - audit-logger
    - gdpr-compliance
    - pii-detector

policy:
  gdpr-compliance:
    consent_required: true
    consent_header: X-User-Consent-Token

  pii-detector:
    action: redact

  audit-logger: {}
FieldTypeDefaultNotes
consent_requiredbooleanfalse at runtime if not specifiedThe policy blocks a request when the configured consent header is missing or empty.
consent_headerstringX-User-Consent-Token at runtime if not specifiedHeader name matching is not case-sensitive.

This check verifies only that the selected header is available and nonempty. It does not validate consent, process erasure requests, or schedule deletion.

EU AI Act (reporting-only)​

eu-ai-act is a reporting-only control. It is not a runtime enforcement policy.

Configure it in policy.eu-ai-act. Generate the compliance report at POST /verdictan/compliance/report.

The report checks if the active executable chain includes the requested article set.

Do not put eu-ai-act in policies.chain. Chain admission fails with the stable cause policy.reporting_only.

Keep the executable Article 9–15 controls in the chain. Examples include prompt-injection, gdpr-compliance, pii-detector, audit-logger, human-oversight, and quality-scorer.

Keep eu-ai-act only in the report configuration.

policies:
  chain:
    - audit-logger
    - prompt-injection
    - gdpr-compliance
    - pii-detector
    - quality-scorer
    - human-oversight

policy:
  eu-ai-act:
    risk_class: high
    articles: [9, 10, 12, 13, 14, 15]

This example escalates each response that reaches human-oversight. Use that entry only on a route where each such response must have review.

FieldTypeDefaultNotes
risk_classstringhighThe compliance report includes this value.
articlesinteger[][9,10,11,12,13,14,15]The report includes this article set.
Use the report fully_covered and gap_count fields as configured-control
inventory. They do not prove legal or operational compliance. Do not use
eu-ai-act as a request gate.

CJIS mode​

cjis-mode is an input policy. The input must have a verified identity with a subject, an organization, and proof that is not expired.

It must also have the configured session age and MFA assurance. Headers that users can spoof do not give access.

policies:
  chain:
    - cjis-mode
    - case-privacy
    - audit-logger

policy:
  cjis-mode:
    require_auth: true
    access_logging: true
    session_timeout_minutes: 30
    required_assurance: multi_factor
FieldTypeDefaultNotes
require_authbooleantrueThe policy blocks a request when a verified identity is missing.
access_loggingbooleantrueThe gateway saves durable CJIS access decision evidence before an allow result.
session_timeout_minutesinteger30This is the maximum remaining proof life. Proofs with a longer life fail the age check.
required_assurancestringmulti_factorThis is the minimum MFA assurance. Values are multi_factor and phishing_resistant.

Output compliance chains​

You can put these supported policy types in the same chain. These examples are text-control starting points. They do not establish regulatory compliance or replace legal review.

Use stream: false for the finance, healthcare, and legal output controls in these examples.

Finance​

policies:
  chain:
    - audit-logger
    - mnpi-filter
    - financial-compliance

policy:
  mnpi-filter:
    detect_patterns:
      - earnings before announcement
      - merger not public

  financial-compliance:
    blocked_patterns:
      - guaranteed returns
      - insider information
    required_disclaimers:
      - This is not financial advice.

Healthcare​

policies:
  chain:
    - audit-logger
    - hipaa-phi-detector
    - pii-detector
    - healthcare-compliance

policy:
  hipaa-phi-detector:
    action: redact

  healthcare-compliance:
    blocked_patterns:
      - specific diagnosis
      - treatment recommendation
    required_disclaimers:
      - This content is informational only and not medical advice.
    fda_class: II
policies:
  chain:
    - audit-logger
    - legal-privilege
    - upl-filter

policy:
  legal-privilege:
    privilege_markers:
      - attorney-client privileged
      - work product

  upl-filter:
    blocked_patterns:
      - draft a court filing for me
      - give me binding legal advice

Export controls​

policies:
  chain:
    - audit-logger
    - itar-ear-filter
    - entity-list-filter
    - dual-use-filter

Chain guidance​

  • A policy.<kind> block runs only when the type also occurs in policies.chain.
  • Reporting-only types are a special case. POST /verdictan/compliance/report uses them, and they must stay out of the chain.
  • gdpr-compliance and cjis-mode are input enforcement checks.
  • eu-ai-act is reporting-only. It is not an input or output enforcement check.
  • financial-compliance, healthcare-compliance, legal-privilege, upl-filter, and mnpi-filter are output checks.
  • If a control is necessary for only some routes, models, or tenants, use conditional chains.

Next steps​