Policyseed docs

Everything needed to run the open-source CLI, keep the policies in a Git repository, and understand the template syntax. The hosted generator and the Audit Kit use the same templates and renderer.

Quick start

Requires Node.js 18 or later. The package is published as policyseed and can be run with npx without installing.

# 1. Write a commented intake.yaml in the current directory
npx policyseed init

# 2. Edit intake.yaml (company, stack, owners, scope, dates)

# 3. Render all 22 policies into ./policies as NN-<slug>.md
npx policyseed build

# 4. Exit 1 if any policy's last revision date is older than its review cadence
npx policyseed check

build writes 22 files named 01-information-security-policy.md through 22-privacy-and-data-protection-policy.md. Each begins with an H1 of your company name and the policy title, followed by the nine standard sections. Commit intake.yaml and the policies/ directory together so the rendered documents can always be traced to the answers that produced them.

CLI reference

policyseed init  [--out <path>] [--force]
    Write a commented intake.yaml (default ./intake.yaml). Refuses to overwrite
    an existing file unless --force is given.

policyseed build [--intake <path>] [--out <dir>]
    Validate intake.yaml and render all 22 templates into <dir> (default
    ./policies) as NN-<slug>.md. Prints a table of ID, file and title.

policyseed check [--intake <path>] [--dir <dir>]
    Read each rendered policy's Revision History table, take the latest date,
    and compare it with review_cadence from intake.yaml
    (Annual = 365 days, Semi-annual = 182, Quarterly = 91).
    Exit 1 and list the overdue policies when any is past due.

policyseed list
    Print the 22 bundled templates with ID, file stem, title and owner role.

policyseed --version | --help

intake.yaml

policyseed init writes every field with a comment listing the allowed values. Enum values are case-sensitive. Lists can be written inline ([AWS, Vercel]) or as - item lines. A complete example:

company: Northwind Cloud Inc
product: Northwind
headcount: 11-50               # 1-10 | 11-50 | 51-200 | 201+
work_model: Remote             # Remote | Hybrid | Office
cloud: [AWS, Vercel]           # AWS, GCP, Azure, Vercel, Fly.io, Hetzner, Cloudflare, Other
scm: GitHub                    # GitHub | GitLab | Bitbucket | Other
cicd: GitHub Actions
idp: Okta                      # Google Workspace | Okta | Microsoft Entra | JumpCloud | None
mfa: true
mdm: Kandji                    # empty if none
password_manager: 1Password    # empty if none
data_types: [PII]              # any of PII, PHI, Payment
app_type: Web SaaS             # Web SaaS | API | Mobile | Multiple
vendors:
  - Supabase
  - Stripe
  - Datadog
security_owner: "Dana Whitfield, CTO"
approver: "Priya Natarajan, CEO"
incident_contact: security@northwindcloud.example
backup_tool: AWS Backup
backup_cadence: Daily
logging_tool: Datadog
tsc_scope: [Security, Availability]   # Security, Availability, Confidentiality
review_cadence: Annual                # Annual | Semi-annual | Quarterly
effective_date: 2026-09-02

Required fields: company, product, security_owner, approver, incident_contact, and at least one entry in cloud and tsc_scope. Free-text fields (cicd, mdm, password_manager, backup_tool, backup_cadence, logging_tool) may be left empty; the templates switch to generic wording when they are.

GitHub Action: fail when a policy review is overdue

policyseed check exits with status 1 when any rendered policy’s most recent revision date is older than the review_cadence allows. Running it on a schedule turns the annual policy review into a failing job rather than a forgotten calendar entry. The workflow below also runs on pull requests that touch the intake or the policies.

# .github/workflows/policy-review.yml
name: Policy review check

on:
  schedule:
    - cron: "0 9 * * 1"   # every Monday 09:00 UTC
  pull_request:
    paths:
      - "intake.yaml"
      - "policies/**"
  workflow_dispatch:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      # Rebuild so the check runs against the committed intake, then fail the
      # job when any policy's last revision date is past its review cadence.
      - run: npx policyseed@latest build --intake intake.yaml --out policies
      - run: npx policyseed@latest check --intake intake.yaml --dir policies

When the job fails, the log lists each overdue policy with its last review date and the number of days since. To clear it, review the policy, add a row to its Revision History table with today’s date, and commit. If you regenerate from the intake, update effective_date so the new row carries the review date; check falls back to effective_date when a policy has no dated row.

Template format

Templates live in templates/ in the repository (content/policies/ in the site) as one Markdown file per policy. Each file has a front matter block and a body with exactly nine H2 sections in a fixed order. The renderer prepends the H1.

Front matter

• id: P01 to P22. slug: the URL slug. title: the policy title.
• short: one sentence used in indexes. owner_role: the default owner role.
• order: 1 to 22, controls file numbering. tsc: list of criteria the policy primarily satisfies.

Sections

In order: 1. Purpose, 2. Scope, 3. Roles and Responsibilities, 4. Policy Statements, 5. Procedures, 6. Exceptions, 7. Enforcement, 8. Review Cadence, 9. Revision History. Section 4 items are written as - **4.1** text, section 5 as - **5.1** text, and section 9 is a four-column table (Version, Date, Description, Approved by) with one initial row.

Syntax

The renderer supports exactly four constructs and nothing else:

• {{key}}: insert a value. Unknown keys render as an empty string. Booleans render as true/false; lists are joined with commas.
• {{#if key}} ... {{/if}}: render the block when the value is truthy (non-empty string, true, non-empty list).
• {{#unless key}} ... {{/unless}}: render the block when the value is falsy.
• {{#each list}} ... {{/each}}: repeat the block for every item; {{this}} is the current item. Iterations are joined with newlines.

Blocks nest and may span lines. A block tag standing alone on a line is removed together with its line, so conditional paragraphs leave no blank lines behind. Runs of three or more blank lines are collapsed.

---
id: P03
slug: access-control-policy
title: Access Control Policy
short: Defines how access is requested, approved, provisioned, reviewed and removed.
owner_role: Security Owner
order: 3
tsc:
- CC6.1
- CC6.2
---

## 1. Purpose

Access control is how {{company}} makes sure that only the right people can
reach {{product}} infrastructure, source code and customer data.

## 4. Policy Statements

- **4.1** Access is granted on the principle of least privilege.
- **4.2** {{#unless idp_none}}{{idp}} is the single source of workforce identity.{{/unless}}{{#if idp_none}}{{company}} maintains a master list of every application account until a central identity provider is adopted.{{/if}}
{{#if has_mdm}}
- **4.3** Every laptop is enrolled in {{mdm}} before it receives credentials.
{{/if}}

## 2. Scope

In-scope hosting providers:
{{#each cloud_list}}
- {{this}}
{{/each}}

## 9. Revision History

| Version | Date | Description | Approved by |
|---|---|---|---|
| {{policy_version}} | {{effective_date}} | Initial release | {{approver}} |

Context keys

The intake is transformed into a flat context before rendering. These are the only keys a template can use.

The 22 templates

Hosted generator and Audit Kit

The web generator runs the same renderer in the browser and stores nothing server-side. The Audit Kit ($39 one-time, see pricing) sends the intake to Claude to rewrite sections 4 and 5 of each policy around your named tools, then builds DOCX files for the 22 policies, an XLSX TSC crosswalk and evidence checklist, DOCX acknowledgment forms and an ICS review calendar, all zipped in the browser. Each kit includes four tailoring passes per policy. The full policy list is at the template index.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.