A mapping is not a certification
Each policy set is mapped to requirements in 12 frameworks. Mapping a set to SOC 2 or ISO/IEC 42001 does not make you compliant. Your auditor still assesses your controls.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
28 AI agent policy templates, mapped to 12 frameworks.
The policy library in the Agent Governor, runtime authorization for AI agents, has 28 ready-made policy sets with 108 rules. Each set is mapped to requirements in SOC 2, ISO/IEC 42001, the EU AI Act, DORA and eight other frameworks.
Ready-made sets mapped to SOC 2, ISO 27001, ISO 42001, the EU AI Act and more. Install one to get your own copy.
Policy set library
28 ready-made sets. Foundations decide what agents may do on a target; guardrails only make decisions stricter.
- Read onlyFoundationAgents may look, never touch.Forbid1Permit2SOC 2ISO 27001NIST 800-53+1v1 · 3 rules · Foundations
- Least privilege starterFoundationLow-risk reads run; changes and exports wait for a person.Forbid1Hold2Permit2SOC 2ISO 27001ISO 42001+4v1 · 5 rules · Foundations
- Production operatorFoundationRoutine work runs; destructive and structural changes do not.Forbid1Hold2Permit2SOC 2ISO 27001NIST 800-53+2v1 · 5 rules · Foundations
- Human in the loopFoundationEvery change waits for a person; reads run.Forbid1Hold1Permit2SOC 2ISO 27001ISO 42001+5v1 · 4 rules · Foundations
- On behalf of a person onlyFoundationThe agent acts only while a person has delegated to it.Forbid1Hold1Permit2SOC 2ISO 27001ISO 42001+4v1 · 4 rules · Foundations
- Analytics and reportingFoundationQuery freely, export with approval, change nothing.Forbid1Hold1Permit2SOC 2ISO 27001NIST 800-53+1v1 · 4 rules · Foundations
- Policy sets
- Rules
- Frameworks mapped
- Decisions replayed per preview
The library groups 28 policy sets into seven categories.
A policy set is a named group of rules. Foundations decide what agents may do on a target. The other six categories are essentials, security, data protection, financial controls, infrastructure, and third parties and oversight.
Install a set to get your own copy, then assign it to every target or to the targets you choose. In the product, search by a framework control, such as CC6.1, to find the sets that cover it.
| Foundations | 4 | 4SOC 2ISO 27001+2 | |
| Foundations | 5 | 5SOC 2ISO 27001+3 | |
| Foundations | 5 | 6ISO 27001ISO 42001+4 | |
| Foundations | 4 | 8SOC 2ISO 27001+6 | |
| Foundations | 5 | 7SOC 2ISO 27001+5 | |
| Foundations | 4 | 7SOC 2ISO 27001+5 | |
| Foundations | 5 | 5SOC 2ISO 27001+3 | |
| Foundations | 3 | 4SOC 2ISO 27001+2 | |
| Foundations | 3 | 4SOC 2ISO 27001+2 | |
| Essentials | 4 | 5SOC 2ISO 27001+3 | |
| Essentials | 3 | 7SOC 2ISO 27001+5 | |
| Essentials | 3 | 5SOC 2ISO 27001+3 | |
| Security | 4 | 4SOC 2ISO 27001+2 | |
| Security | 3 | 5SOC 2ISO 27001+3 | |
| Security | 4 | 4SOC 2ISO 27001+2 | |
| Data protection | 3 | 5SOC 2ISO 27001+3 | |
| Data protection | 2 | 4ISO 27001OWASP LLM+2 | |
| Data protection | 2 | 5SOC 2ISO 27001+3 | |
| Data protection | 4 | 5SOC 2ISO 27001+3 | |
| Financial controls | 4 | 5SOC 2ISO 27001+3 | |
| Financial controls | 3 | 7SOC 2ISO 42001+5 | |
| Infrastructure | 5 | 5SOC 2ISO 27001+3 | |
| Infrastructure | 2 | 5SOC 2ISO 27001+3 | |
| Infrastructure | 4 | 7SOC 2ISO 27001+5 | |
| Infrastructure | 9 | 5SOC 2ISO 27001+3 | |
| Infrastructure | 7 | 5SOC 2ISO 27001+3 | |
| Third parties and oversight | 2 | 7SOC 2ISO 27001+5 | |
| Third parties and oversight | 2 | 8SOC 2ISO 27001+6 |
Financial reporting controls (SOX)
Guardrailv1 Financial controls · 4 rulesWrites to ledgers, journals, invoices, payments and vendor bank details wait for a person, so an agent never both initiates and approves a financial change. Deletes and structural changes to financial records are refused.
Forbid2Hold2- ForbidForbid deleting or restructuring financial recordspriority 10Delete, Schema change · *ledger*, *journal*, gl_*, *.gl_* and 5 moreFinancial records are retained and corrected by reversal, never deleted.
- HoldHold writes to financial recordspriority 20Write · *ledger*, *journal*, gl_*, *.gl_* and 6 moreSegregation of duties: a person approves every entry an agent proposes.
- HoldHold payments, payouts and transferspriority 20Write, Delete, Data export · */payments*, */payouts*, */transfers*, *refunds* and 4 moreMoney that leaves cannot be recalled.
- ForbidForbid changing vendor bank detailspriority 5Write, Delete · *bank_account*, *vendor_bank*, *remit_to*, *iban* and 1 moreChanging where payments go is the classic business email compromise.
Helps meet
SOX ITGCSegregation of duties: no one actor initiates and approves a financial changeChange management: program and configuration changes are approved
SOC 2CC5.1 Control activities mitigate risksand 2 more
Mapped to 5 of 12 frameworks
- SOC 23 requirements
- ISO/IEC 27001:20222 requirements
- NIST SP 800-53 Rev. 53 requirements
- EU AI Act1 requirement
- SOX ITGC2 requirements
Every set in the library with its category, rule count and the number of frameworks it is mapped to. Choose a set to see its detail; rules and descriptions appear where the product screens show them. Counts come from the library export of November 5, 2026.
Data
| Policy set | Category | Rules | Frameworks |
|---|---|---|---|
| Read only | Foundations | 3 | 4 |
| Least privilege starter | Foundations | 5 | 7 |
| Production operator | Foundations | 5 | 5 |
| Human in the loop | Foundations | 4 | 8 |
| On behalf of a person only | Foundations | 4 | 7 |
| Analytics and reporting | Foundations | 4 | 4 |
| Customer support desk | Foundations | 5 | 6 |
| CI/CD and deployment agents | Foundations | 5 | 5 |
| Sandbox and test | Foundations | 3 | 4 |
| Essential agent guardrails | Essentials | 3 | 7 |
| No destructive operations | Essentials | 3 | 5 |
| Data loss prevention | Essentials | 4 | 5 |
| Secrets and credentials | Security | 4 | 4 |
| Personal data protection | Data protection | 4 | 5 |
| Payroll and HR records | Data protection | 2 | 5 |
| Cardholder data (PCI DSS) | Data protection | 3 | 5 |
| Health information (HIPAA) | Data protection | 2 | 4 |
| Financial reporting controls (SOX) | Financial controls | 4 | 5 |
| Trading and treasury | Financial controls | 3 | 7 |
| Identity and SaaS admin safety | Security | 4 | 4 |
| Protect security tooling | Security | 3 | 5 |
| Change management | Infrastructure | 2 | 5 |
| AWS control plane | Infrastructure | 5 | 5 |
| Kubernetes clusters | Infrastructure | 9 | 5 |
| Server shell access | Infrastructure | 7 | 5 |
| Code sandboxes | Infrastructure | 4 | 7 |
| Third-party and vendor agents | Third parties and oversight | 2 | 8 |
| High-risk AI oversight (EU AI Act) | Third parties and oversight | 2 | 7 |
ISO/IEC 27001, SOC 2 and NIST SP 800-53 have the most sets mapped to them.
Each cell counts the requirements in one framework that a set is mapped to. ISO/IEC 27001 has 27 sets mapped to it, and SOC 2 and NIST SP 800-53 have 26 each.
Some frameworks are mapped narrowly. HIPAA and PCI DSS each have one set, and DORA has three. Sort by category or by framework to see where a gap sits.
Scroll sideways for more →
| Read only | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Least privilege starter | 5 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Production operator | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Human in the loop | 4 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| On behalf of a person only | 4 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Analytics and reporting | 4 | 3 | 3 | 0 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 |
| Customer support desk | 5 | 0 | 1 | 1 | 0 | 1 | 2 | 1 | 3 | 0 | 0 | 0 | 0 |
| CI/CD and deployment agents | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Sandbox and test | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Essential agent guardrails | 3 | 2 | 3 | 1 | 2 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| No destructive operations | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
| Data loss prevention | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Secrets and credentials | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Identity and SaaS admin safety | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Protect security tooling | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 1 | 0 |
| Personal data protection | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Payroll and HR records | 2 | 2 | 3 | 0 | 1 | 0 | 2 | 0 | 3 | 0 | 0 | 0 | 0 |
| Cardholder data (PCI DSS) | 3 | 1 | 1 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 3 | 0 | 0 |
| Health information (HIPAA) | 2 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 3 | 3 | 0 | 0 | 0 |
| Financial reporting controls (SOX) | 4 | 3 | 2 | 0 | 3 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 2 |
| Trading and treasury | 3 | 1 | 0 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| Change management | 2 | 2 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 1 |
| AWS control plane | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Kubernetes clusters | 9 | 3 | 4 | 0 | 3 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Server shell access | 7 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Code sandboxes | 4 | 3 | 3 | 1 | 2 | 1 | 2 | 1 | 0 | 0 | 0 | 0 | 0 |
| Third-party and vendor agents | 2 | 2 | 2 | 2 | 1 | 1 | 2 | 1 | 0 | 0 | 0 | 1 | 0 |
| High-risk AI oversight (EU AI Act) | 2 | 1 | 1 | 1 | 1 | 1 | 1 | 2 | 0 | 0 | 0 | 0 | 0 |
| Sets mapped | 108 | 26 | 27 | 9 | 26 | 9 | 24 | 12 | 5 | 1 | 1 | 3 | 10 |
Each dot is the number of requirements in that framework a policy set maps to; no dot means none. The bottom row counts the sets mapped to each framework. Exported from the policy library on November 5, 2026. A mapping is not a certification.
Data
| Policy set | Category | Rules | SOC 2 | ISO/IEC 27001:2022 | ISO/IEC 42001:2023 | NIST SP 800-53 Rev. 5 | NIST AI RMF 1.0 | OWASP Top 10 for LLM Applications 2025 | EU AI Act | GDPR | HIPAA Security Rule | PCI DSS v4.0 | DORA | SOX ITGC |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Read only | Foundations | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Least privilege starter | Foundations | 5 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Production operator | Foundations | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Human in the loop | Foundations | 4 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| On behalf of a person only | Foundations | 4 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Analytics and reporting | Foundations | 4 | 3 | 3 | 0 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 |
| Customer support desk | Foundations | 5 | 0 | 1 | 1 | 0 | 1 | 2 | 1 | 3 | 0 | 0 | 0 | 0 |
| CI/CD and deployment agents | Foundations | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Sandbox and test | Foundations | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Essential agent guardrails | Essentials | 3 | 2 | 3 | 1 | 2 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| No destructive operations | Essentials | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
| Data loss prevention | Essentials | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Secrets and credentials | Security | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Personal data protection | Data protection | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Payroll and HR records | Data protection | 2 | 2 | 3 | 0 | 1 | 0 | 2 | 0 | 3 | 0 | 0 | 0 | 0 |
| Cardholder data (PCI DSS) | Data protection | 3 | 1 | 1 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 3 | 0 | 0 |
| Health information (HIPAA) | Data protection | 2 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 3 | 3 | 0 | 0 | 0 |
| Financial reporting controls (SOX) | Financial controls | 4 | 3 | 2 | 0 | 3 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 2 |
| Trading and treasury | Financial controls | 3 | 1 | 0 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| Identity and SaaS admin safety | Security | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Protect security tooling | Security | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 1 | 0 |
| Change management | Infrastructure | 2 | 2 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 1 |
| AWS control plane | Infrastructure | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Kubernetes clusters | Infrastructure | 9 | 3 | 4 | 0 | 3 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Server shell access | Infrastructure | 7 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Code sandboxes | Infrastructure | 4 | 3 | 3 | 1 | 2 | 1 | 2 | 1 | 0 | 0 | 0 | 0 | 0 |
| Third-party and vendor agents | Third parties and oversight | 2 | 2 | 2 | 2 | 1 | 1 | 2 | 1 | 0 | 0 | 0 | 1 | 0 |
| High-risk AI oversight (EU AI Act) | Third parties and oversight | 2 | 1 | 1 | 1 | 1 | 1 | 1 | 2 | 0 | 0 | 0 | 0 | 0 |
| Sets mapped | 108 | 26 | 27 | 9 | 26 | 9 | 24 | 12 | 5 | 1 | 1 | 3 | 10 |
When rules conflict, the strictest one applies.
If more than one rule matches an action, the governor uses the strictest. A Forbid rule refuses the action even when a Hold or Permit rule also matches, and a Hold rule sends it to a person even when a Permit rule matches.
Foundation sets decide what agents may do on a target. Guardrail sets contain only Hold and Forbid rules, so adding one can make a decision stricter but cannot loosen it. Each rule has a priority, and lower numbers run first. An action that no rule permits is denied.
- ForbidNo privilege changes1
- HoldExports need a person2
- PermitReads3
DecisionForbidRefused before a credential exists.
When more than one rule matches an action, the strictest effect decides. Switch a rule off to see the next one take over. Illustrative data from a Coverbase demo org.
Data
| Order | Effect | What happens |
|---|---|---|
| 1 | Forbid | The action is refused |
| 2 | Hold | The action waits for a person |
| 3 | Permit | The action runs |
Organization settings can raise a decision to Hold or Deny but cannot lower it.
Configuration › Agent Governor holds the rules that sit above every target. Hold and deny thresholds act on the risk score. The session guard holds an export after a sensitive read in the same session. Approval settings say who may approve and the risk at which two people must.
Change a value and the side panel replays your last 1,000 decisions to show what would change.
Risk · hold at or above
Risk · deny at or above
Session guard
Holds an export after a sensitive read in the same session.
Approvals
Two people must approve at risk 80 or aboveAlso set: who may approve, when an undecided request expires, the longest window an approval can cover.- support-copilot· zendesk-apirisk 62
POST /api/v2/tickets/48211/refundPolicyPermitDecisionHoldStricter · Risk 62 ≥ hold threshold 50 - copilot-studio-hr· aws-prodrisk 88
iam:CreateRoleAssignmentPolicyHoldDecisionDenyStricter · Risk 88 ≥ deny threshold 80 - reporting-bot· analytics-dbrisk 60
COPY public.orders TO STDOUTEarlier in this session:SELECT name, email, total FROM paymentsPolicyPermitDecisionHoldStricter · Risk 60 ≥ hold threshold 50
Change a threshold or the session guard and the three actions are decided again. The policy result never gets looser; a setting can only raise it to Hold or Deny. Example thresholds. Illustrative data from a Coverbase demo org.
Data
| Action | Risk | Policy result | Final decision |
|---|---|---|---|
| support-copilot · zendesk-api · POST /api/v2/tickets/48211/refund | 62 | Permit | Hold (Risk 62 ≥ hold threshold 50) |
| copilot-studio-hr · aws-prod · iam:CreateRoleAssignment | 88 | Hold | Deny (Risk 88 ≥ deny threshold 80) |
| reporting-bot · analytics-db · COPY public.orders TO STDOUT | 60 | Permit | Hold (Risk 60 ≥ hold threshold 50) |
Preview a change before you save it, and keep your edits when the library updates.
Before you save a rule, the preview replays recent decisions under the change and shows which would now be denied, held or allowed.
When the library publishes a new version of a set you installed, the set says so. Update applies what the library added and changed, and the rules you changed are kept as they are. Duplicate makes a copy that no longer follows the library.
If you save this
200 recent decisions on analytics-db3 would be denied1 held0 allowed
#4120 SELECT * FROM payroll.salaries · allow → deny
4 decisions were stopped or failed before policy and are left out.
CancelSave rule
Saving a rule replays recent decisions on its target first. A change to organization settings replays your last 1,000 decisions. Illustrative data from a Coverbase demo org.
Data
| Replayed decisions | Would be denied | Would be held | Would be allowed | Left out |
|---|---|---|---|---|
| 200 on analytics-db | 3 | 1 | 0 | 4 |
- Policy sets5 sets · 1 update available
- Essential agent guardrailsGuardrailFrom the library, version 1· Every targetForbid2Hold1
- Least privilege starterUpdate availableFoundationFrom the library, version 1· analytics-db, aws-prodForbid1Hold2Permit2
- Financial reporting controls (SOX)GuardrailFrom the library, version 1 · 1 rule changed· Every targetForbid2Hold2
- Personal data protectionGuardrailFrom the library, version 1· analytics-dbForbid1Hold3
- Zendesk refunds deskFoundationYour own set· zendesk-apiForbid2Hold1Permit2
Least privilege starter
FoundationFrom the library, version 1Version 2 is available (you have 1)1 added, 1 changed, 0 removed. 1 rule you changed is kept as it is.
Version 1 rules
- PermitAgents may reach the target100
- ForbidForbid privilege and credential changes10
- HoldHold data exports20
- HoldHold writes and deletes30
- PermitPermit low-risk reads100
Least privilege starter has a new library version. Update applies what the library added and changed and keeps the rule you changed as it is. Illustrative data from a Coverbase demo org.
Data
| Set | Kind | Applies to | Source |
|---|---|---|---|
| Essential agent guardrails | Guardrail | Every target | From the library, version 1 |
| Least privilege starter | Foundation | analytics-db, aws-prod | From the library, version 1 |
| Financial reporting controls (SOX) | Guardrail | Every target | From the library, version 1 · 1 rule changed |
| Personal data protection | Guardrail | analytics-db | From the library, version 1 |
| Zendesk refunds desk | Foundation | zendesk-api | Your own set |
What the governor does not do.
The observed tier acts after the fact
For a vendor agent acting inside its own product, the governor reads the audit log, flags an action your rules forbid and can suspend the agent. It cannot stop that single action before it happens.
The identity bound tier acts on the agent, not the action
When the governor cannot sit in front of a vendor agent, it suspends the agent's identity in Entra, Okta or Salesforce and revokes its grants. It does not decide each action that agent takes.
Start from a set mapped to the frameworks you report on.
Tell us which frameworks your auditors ask about. We install the matching sets on a test target and preview them against recent decisions with you.