Skip to Content
EnterpriseCompliance Pack

Compliance Pack

Enterprise (compliance_pack entitlement). Make the guardrails mandatory across the whole org, and get a posture report you can hand to an auditor. The open-source platform ships the guardrail plugins (pii-filter and security-scanner), but each agent opts in individually. The compliance pack turns them into org policy: a central declaration of which guardrails are required and how strict they are.

An agent's guardrail constraints, which the org policy makes mandatory platform-wide

This is the operational half of the story told on the Compliance page: Art. 9 risk management wants demonstrable, organization-wide controls, not per-agent good intentions.

The org policy

Set the policy under Settings (admin/owner only). It declares which built-in guardrails are enforced org-wide and how they behave:

{
  "enforcedPlugins": ["pii-filter", "security-scanner"],
  "securityThreshold": "medium",
  "blockOnViolation": true,
  "piiCategories": []
}
FieldValuesMeaning
enforcedPluginspii-filter, security-scannerwhich built-in guardrails are mandatory org-wide
securityThresholdlow | medium | high | criticalseverity at which the security-scanner acts
blockOnViolationbooleanblock the offending call vs. log-and-continue
piiCategoriesstring[]PII categories to filter; empty = all

Secure by default: until an admin configures a policy, the effective policy enforces both plugins with securityThreshold: medium and blockOnViolation: true. Configuring can only relax from there, deliberately. Reading the policy back returns the effective policy, including whether it is the default or configured.

The posture report

The report is designed to attach to a conformity file as-is (defaults to the last 30 days; the endpoint and its date range are in the API reference):

  • Effective policy for the window.
  • Enforced controls: per plugin, enforced or not, and the effective settings (threshold, blocking, categories).
  • Activity: audit-log-derived counts (total events, breakdown by action, how many were scannable executions, and credential-access events).
  • Posture score (0 to 100): a blunt summary. 40 points per enforced guardrail plugin, 20 for blocking mode. Full marks means both guardrails enforced and violations blocked, not merely logged.
Audit Export & SIEMControl via MCP