Draft a SOC 2 policy grounded in your actual setup
draft_policyGenerate a Markdown policy draft grounded in your compliance answers and optional scan results, with explicit placeholders for unresolved decisions so you can review before approval.
Instructions
Produces a policy DRAFT in Markdown, grounded in the answers you gave to applicability_brief and, optionally, a real scan. Returned as a string; this server writes no files. Every judgment call is left as an explicit {{PLACEHOLDER}}, counted and returned separately rather than silently filled with a plausible default — because a policy describing controls you do not actually operate is worse than no policy, and becomes an audit exception. The draft states in its own header that having the document does not satisfy the criteria it supports; SOC 2 also wants evidence it was approved, communicated, acknowledged and followed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | Which policy to draft | |
| cloud | No | ||
| batchId | No | Optional scan batch to ground the draft in | |
| premises | No | ||
| timeline | No | ||
| workforce | No | ||
| companyName | No | Company name. Omitted leaves a placeholder. | |
| iacCoverage | No | ||
| customerData | No | ||
| changeProcess | No | ||
| productionAccess | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | ||
| title | Yes | ||
| markdown | Yes | ||
| warnings | Yes | Set when the draft would describe a control you do not operate. | |
| groundedIn | Yes | Facts from your answers and scan that shaped this draft. | |
| alsoRequires | Yes | What else you must produce beyond the document. | |
| placeholders | Yes | Every {{PLACEHOLDER}} a human must resolve before use. | |
| placeholderCount | Yes | ||
| supportsCriteria | Yes | Criteria this CONTRIBUTES toward. A policy never satisfies one on its own. | |
| suggestedFilename | Yes |