Custom Policies

Define organization-specific compliance rules and policies beyond standard regulations.

Overview

RegPilot’s policy engine allows you to:

Create custom compliance rules
Define industry-specific requirements
Implement company policies
Automate policy enforcement

Policy Types

Content Policies

Control what AI can say or do:

contentPolicy:
  name: "Financial Advice Policy"
  rules:
    - type: "prohibited_content"
      patterns:
        - "guaranteed returns"
        - "risk-free investment"
        - "cannot lose money"
      action: "block"
      severity: "high"
    
    - type: "required_disclaimer"
      triggers:
        - "investment advice"
        - "stock recommendation"
      disclaimer: "This is not financial advice. Consult a licensed advisor."
      action: "append"

Data Policies

Manage sensitive data handling:

dataPolicy:
  name: "PII Protection Policy"
  rules:
    - type: "pii_detection"
      categories:
        - "email"
        - "phone"
        - "ssn"
        - "credit_card"
      action: "redact"
      notification: true
    
    - type: "data_retention"
      maxAge: "90 days"
      autoDelete: true

Model Policies

Control AI model usage:

modelPolicy:
  name: "Approved Models Only"
  rules:
    - type: "allowlist"
      models:
        - "gpt-4"
        - "gpt-3.5-turbo"
        - "claude-3-opus"
      action: "block_others"
    
    - type: "cost_limit"
      maxCostPerRequest: 0.50
      action: "require_approval"

Creating Custom Policies

Via Dashboard

Navigate to Settings → Policies
Click Create Custom Policy
Select policy type
Define rules and actions
Test policy
Enable policy

Via API

const policy = await fetch('https://regpilot.dev/api/policies', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.REGPILOT_API_KEY,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: "Healthcare HIPAA Policy",
    type: "content",
    enabled: true,
    rules: [
      {
        id: "no-phi",
        description: "Block Protected Health Information",
        pattern: /\\b(patient|diagnosis|treatment|medical record)\\b/i,
        action: "block",
        severity: "critical"
      },
      {
        id: "required-disclaimer",
        description: "Add HIPAA disclaimer",
        trigger: "medical_context",
        action: "append",
        content: "This information is not medical advice."
      }
    ]
  })
});

Policy Rule Syntax

Pattern Matching

rules: [
  {
    // Exact match
    pattern: "exact phrase",
    matchType: "exact"
  },
  {
    // Regex pattern
    pattern: /\\b(term1|term2)\\b/i,
    matchType: "regex"
  },
  {
    // Keyword list
    keywords: ["word1", "word2", "word3"],
    matchType: "any" // or "all"
  },
  {
    // Semantic similarity
    concept: "financial_advice",
    threshold: 0.8,
    matchType: "semantic"
  }
]

Actions

Available actions when a policy rule triggers:

block - Reject the request
warn - Allow with warning
redact - Remove matching content
replace - Substitute with safe content
append - Add disclaimer/notice
require_approval - Human review
log - Record but allow
notify - Send alert

Severity Levels

severity: "info" | "low" | "medium" | "high" | "critical"

Policy Examples

Financial Services

name: "SEC Compliance Policy"
rules:
  # Prohibit forward-looking statements
  - pattern: /(will|expect|anticipate|believe).*(?:increase|profit|growth)/i
    action: "warn"
    message: "Forward-looking statement detected. Add safe harbor disclaimer."
  
  # Require disclosure
  - trigger: "performance_data"
    action: "append"
    content: "Past performance does not guarantee future results."
  
  # Block insider information
  - keywords: ["material non-public", "insider trading", "MNPI"]
    action: "block"
    severity: "critical"

Healthcare (HIPAA)

name: "HIPAA Compliance Policy"
rules:
  # PHI Detection
  - type: "pii_detection"
    categories: ["medical_record_number", "diagnosis", "prescription"]
    action: "redact"
    replacement: "[REDACTED PHI]"
  
  # Minimum necessary
  - check: "data_minimization"
    threshold: 0.7
    action: "warn"
  
  # Business Associate requirement
  - trigger: "phi_processing"
    action: "require_approval"
    approver: "privacy_officer"

Education (FERPA)

name: "FERPA Student Privacy Policy"
rules:
  # Student record protection
  - keywords: ["student ID", "grade", "transcript", "enrollment"]
    context: "personally_identifiable"
    action: "redact"
  
  # Parental consent
  - check: "student_under_18"
    action: "require_consent"
    consentType: "parental"

Policy Testing

Test Before Deployment

// Test policy against sample data
const testResult = await fetch('https://regpilot.dev/api/policies/test', {
  method: 'POST',
  headers: { 'X-API-Key': API_KEY },
  body: JSON.stringify({
    policyId: "policy_123",
    testCases: [
      {
        input: "Buy this stock - guaranteed 50% returns!",
        expectedAction: "block",
        expectedSeverity: "high"
      },
      {
        input: "Historical data shows growth trends",
        expectedAction: "allow"
      }
    ]
  })
});

console.log(testResult.passed, testResult.failed);

A/B Testing

Enable shadow mode to test policies without blocking:

policy: {
  enabled: true,
  shadowMode: true, // Log violations but don't block
  shadowDuration: "7 days"
}

Policy Management

Versioning

Policies support version control:

// Create new version
POST /api/policies/{id}/versions

// Rollback to previous version
POST /api/policies/{id}/rollback
{
  "version": "v1.2"
}

// Compare versions
GET /api/policies/{id}/diff?from=v1.0&to=v2.0

Policy Sets

Group related policies:

const policySet = {
  name: "Financial Services Compliance",
  policies: [
    "sec-compliance",
    "finra-rules",
    "anti-money-laundering",
    "fair-lending"
  ],
  enforcementMode: "strict" // or "permissive"
};

Approval Workflows

policyApproval: {
  required: true,
  approvers: [
    { role: "legal", required: true },
    { role: "compliance", required: true },
    { role: "security", required: false }
  ],
  minApprovals: 2
}

Monitoring Policy Effectiveness

Policy Analytics

Track policy performance:

GET /api/policies/analytics?policyId={id}&period=30d

Response: {
  triggers: 1543,
  blocks: 234,
  warnings: 892,
  falsePositives: 12,
  effectiveness: 0.92
}

Audit Logs

All policy actions are logged:

GET /api/policies/audit-logs

Response: {
  logs: [
    {
      timestamp: "2025-11-18T10:30:00Z",
      policyId: "policy_123",
      ruleId: "no-phi",
      action: "block",
      user: "user_456",
      input: "[REDACTED]",
      reason: "PHI detected: diagnosis"
    }
  ]
}

Best Practices

1. Start Permissive

Begin with warning-only policies:

Monitor false positives
Tune patterns and thresholds
Gradually increase strictness

2. Layer Policies

Combine multiple policies for defense in depth:

Broad category policies (e.g., “No PII”)
Specific industry policies (e.g., “HIPAA”)
Custom org policies (e.g., “Company code of conduct”)

3. Clear Documentation

Document each policy:

Purpose and scope
Affected systems
Exceptions process
Review schedule

4. Regular Review

Schedule policy reviews:

Quarterly effectiveness review
Annual comprehensive audit
After major incidents
When regulations change

5. User Education

Train users on policies:

Policy overview training
Real example scenarios
What to do when blocked
Exception request process

Need Help?

📧 Email: policies@regpilot.dev
💬 Community: RegPilot Slack
📚 Docs: Governor Configuration

Getting Started

Core Features

AI Gateway

EU AI Act Compliance

API Reference

Integration Guides

Best Practices

Advanced

​Custom Policies

​Overview

​Policy Types

​Content Policies

​Data Policies

​Model Policies

​Creating Custom Policies

​Via Dashboard

​Via API

​Policy Rule Syntax

​Pattern Matching

​Actions

​Severity Levels

​Policy Examples

​Financial Services

​Healthcare (HIPAA)

​Education (FERPA)

​Policy Testing

​Test Before Deployment

​A/B Testing

​Policy Management

​Versioning

​Policy Sets

​Approval Workflows

​Monitoring Policy Effectiveness

​Policy Analytics

​Audit Logs

​Best Practices

​1. Start Permissive

​2. Layer Policies

​3. Clear Documentation

​4. Regular Review

​5. User Education

​Need Help?

Custom Policies

Overview

Policy Types

Content Policies

Data Policies

Model Policies

Creating Custom Policies

Via Dashboard

Via API

Policy Rule Syntax

Pattern Matching

Actions

Severity Levels

Policy Examples

Financial Services

Healthcare (HIPAA)

Education (FERPA)

Policy Testing

Test Before Deployment

A/B Testing

Policy Management

Versioning

Policy Sets

Approval Workflows

Monitoring Policy Effectiveness

Policy Analytics

Audit Logs

Best Practices

1. Start Permissive

2. Layer Policies

3. Clear Documentation

4. Regular Review

5. User Education

Need Help?