Policy library
Governance → Policy Management
The library holds every governing document your organisation has, at every stage of its life — the draft somebody started this morning and the standard that has been effective for three years sit in the same list, distinguished by status rather than by location.
Four classes of document
All four share one table, one lifecycle and one set of screens. What separates them is what they are for:
| Class | Answers | Example |
|---|---|---|
| Policy | What and why — the organisation's requirements, as "shall" statements | Information Security Policy |
| Standard | The specific bar a requirement has to clear | Password Standard |
| Procedure | How — the steps a practitioner actually performs | User Access Review Procedure |
| Guideline | Recommended practice, not mandatory | Secure Development Guideline |
The distinction is not cosmetic. When you draft a document with AI, the model is given a different brief for a policy than for a procedure: a policy gets directive requirement statements, a procedure gets numbered, executable steps naming who does what, with which system, producing which record. Setting the class wrongly produces a document of the wrong kind.
Hierarchy
A document can have a parent. That is what turns a flat list into a structure: procedures hang under the policy they implement, and the framework scaffold uses this to create one governing policy with its procedures nested underneath.
The library shows the parent's name on each child row, so a procedure is never orphaned on screen from the policy it serves.
Categories
Every document carries one category, used for filtering and to steer AI drafting:
information_security · data_privacy · acceptable_use · access_control ·
business_continuity · incident_management · risk_management ·
compliance · hr · operational · financial · governance · other
Creating a document
Governance → Policy Management → New Policy (manager role or above).
| Field | Required | Notes |
|---|---|---|
| Policy name | Yes | 2–500 characters |
| Category | Yes | From the list above |
| Review frequency | No | Quarterly, semi-annual, annual or biennial — defaults to annual. Each schedules the next review on approval |
| Description | No | A sentence on what the document is for; it is fed to the AI author |
A new document is created in draft at version 1.0, owned by whoever created
it unless another owner is given. Nothing about it is visible to the wider
organisation until it is published.
Finding a document
The library filters on search (title and description, case-insensitive),
category and status, and pages 10 at a time. Search is a substring
match, not a full-text index — searching for access finds "Access Control
Policy" and "Remote access standard", but not a document that only mentions
access in its body.
The policy code
policyCode is a short human reference — POL-IS-001, SEC-STD-04, whatever
your numbering convention is. It is unique within your organisation, so two
documents cannot share one, and it is what people will quote in an audit rather
than a UUID.
Deleting
A document can only be deleted while it is in draft, and only by an
organisation administrator. Once anything has been submitted for review it has
started accumulating a record — reviewers, approvals, versions — and the way
out is retirement, not deletion.
Deleting a draft removes its versions, approvals, acknowledgments, exceptions and mappings with it.
What a document page gives you
Opening a document from the library gives you the file card and seven tabs:
| Tab | What it is for |
|---|---|
| Details | Metadata, and the lifecycle action for the current status |
| Content | The structured body, in English and Arabic |
| Versions | Every version, its change reason and its state |
| Approvals | Who approved, returned or rejected, and when |
| Acknowledgments | The attestation campaign and who has responded |
| Exceptions | Departures from this document |
| Mappings | The framework and risk controls it governs |