Policy packs

Three properties, each of which is a decision rather than a convenience:

installed watching     every rule lands with monitorMode: true. Nothing is refused on install day.
never overwrites       a rule id already in your store is skipped and named — edited, armed, or not.
its own vocabulary     packs do not restate the built-ins. They add the regulation's action names
                       and thresholds under their own rule ids, so a refusal in the record names
                       the regime it was made under.

Each installed rule is chained as a policy_created event carrying the rule's English, its effect and its content-hash version — exactly as a typed rule would be. Before arming any of them, replay the record through it from the Rules page: the simulation names which of your last 500 actions it would have held or refused.

The action names below are the vocabulary each pack listens for. Your agents name their own actions; where yours differ, edit the installed rule's in list — the edit is versioned, and the pack will not put the original back.

eu-ai-act-art-12 · European Union · high-risk obligations apply 2 December 2027. Consequential decisions are held for a named human, carry a reason the record can show, and a run that will not stop is stopped.

credit_decision · loan_decision · hiring_decision · insurance_decision · benefits_decision
housing_decision · education_decision · medical_triage · adverse_decision

{ "all": [ { "field": "action", "op": "in", "value": [ …consequential ] },
           { "field": "approvalId", "op": "missing" } ] }

Art 14(1), 14(4)(d). Human oversight measures must let a person decide not to use, or to override, the system's output. Holding a consequential decision until a named human releases it is that measure, and the release is chained under their name.

{ "all": [ { "field": "action", "op": "in", "value": [ …consequential ] },
           { "field": "reason", "op": "missing" } ] }

Art 12(2)(a), Art 13(3)(b). Logging must make it possible to identify the situations that led to a result. A consequential decision recorded without a reason is a result with no situation behind it, so it is refused and the refusal is chained.

{ "field": "sessionIterations", "op": "gt", "value": 200 }

Art 14(4)(e). A person must be able to intervene or interrupt through a stop procedure. The kill switch is the manual stop; this is the automatic one, with a cap wide enough that only a loop trips it. The built-in cost-velocity rule caps at 50 when armed — this one exists so the record shows an Art 14 policy id.

Article 50 — telling a person they are talking to a machine — is not a rule in this pack, because it is not a decision: it is a disclosure event the voice adapters record per call, and the Compliance page answers it from the record.

finra-supervision · United States broker-dealers · in force today, with SEC 17a-4 retention alongside. Trade instructions and customer communications wait for a principal; account changes carry a reason; the record is the books.

{ "all": [ { "field": "action", "op": "in",
             "value": [ "place_order", "submit_trade", "execute_trade", "modify_order", "cancel_order", "allocate_trade" ] },
           { "field": "approvalId", "op": "missing" } ] }

Rule 3110(a), 3110(b)(2). A member's supervisory system must cover the activities of each person, and FINRA's 2026 Oversight Report extends that to agent actions. Holding an order until a registered principal releases it is supervision that the record can show happened, per order.

{ "all": [ { "field": "action", "op": "in",
             "value": [ "send_customer_email", "send_customer_message", "send_recommendation", "publish_research" ] },
           { "field": "approvalId", "op": "missing" } ] }

Rule 2210(b)(1), 3110(b)(4). Retail communications need a registered principal's approval before use, and correspondence must be reviewed under written procedures. An agent's outbound message is held at the line and released under a name.

{ "all": [ { "field": "action", "op": "in",
             "value": [ "update_account", "change_beneficiary", "change_address", "change_bank_details" ] },
           { "field": "reason", "op": "missing" } ] }

Rule 4511, 4512; SEC 17a-3(a)(17). Books and records must be made and preserved, including customer account information and the basis for changes. A change with no stated reason is refused so the record never carries an unexplained one.

Money movement above your threshold is the built-in human-signoff-above-threshold rule and is not restated here.

colorado-sb-26-189 · Colorado · effective 1 January 2027. SB 26-189 is the 2026 act that replaced the repealed SB 24-205 (repealed and replaced by the legislature, signed 14 May 2026, effective 1 January 2027) — the pack is mapped to the act in force, not the repealed one. An adverse decision about a person states its reasons, reaches a human with authority to override, and a consumer's appeal reaches one too.

deny_application · deny_credit · deny_housing · deny_insurance · deny_benefits · deny_education
decline_claim · reject_candidate · adverse_decision

{ "all": [ { "field": "action", "op": "in", "value": [ …adverse ] },
           { "field": "reason", "op": "missing" } ] }

Notice of adverse decision — principal reasons, within 30 days. The deployer must tell the consumer the principal reasons for an adverse consequential decision. A decision refused when its reason is absent is the only way the record can guarantee there is a reason to give.

{ "all": [ { "field": "action", "op": "in", "value": [ …adverse ] },
           { "field": "approvalId", "op": "missing" } ] }

Meaningful human review with override authority. The act requires an opportunity for human review by a person with authority to overturn the decision. Holding the decision until a named reviewer releases or refuses it puts that review on the chain, per decision. Forbid wins: a decision with no reason is refused before it is ever held.

{ "all": [ { "field": "action", "op": "in",
             "value": [ "appeal_decision", "request_human_review", "correct_personal_data" ] },
           { "field": "approvalId", "op": "missing" } ] }

Right to appeal and to correct data; records retained 3 years. A consumer may appeal and may correct the data a decision relied on. Routing those actions to a person — and chaining the answer — is the retained record the act asks for. Retention is a property of the store, not a rule: the chain is append-only and its anchors are write-once.

It does not make you compliant. It arms — once you arm it — the runtime controls a regulation asks for, and puts each decision on a record an assessor can check. Whether the mapping above answers the clause is a reading; Auditant states what the record proves, and the reading is yours.

It does not know your action names. Packs listen for a vocabulary; if your agents call the tool approve_loan rather than loan_decision, add it to the installed rule's list. The simulation on the Rules page will tell you, before you arm it, how often the rule as written would have fired on your own record.