Policy JSON
{
"guard": {
"prompt_injection": {
"enabled": true,
"sensitivity": "high",
"action": "DENY",
"log_attempts": true
},
"pii_detection": {
"enabled": true,
"action": "REDACT",
"patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS", "DOB", "NAME"],
"redact_in_logs": true
},
"content_moderation": {
"enabled": true,
"threshold": 0.5,
"categories": ["hate", "violence", "sexual", "self_harm", "harassment", "dangerous_content"],
"action": "DENY"
}
},
"secrets": {
"enabled": true,
"confidence_threshold": 0.8,
"categories": ["api_keys", "tokens", "passwords", "cloud_secrets"],
"actions": {
"critical": "DENY",
"high": "DENY",
"medium": "DENY"
}
},
"registry": {
"models": ["gpt-4o", "claude-3-5-sonnet"],
"strict": true,
"tools": [],
"deny_unlisted": true,
"verify_provenance": true,
"require_hash": true
},
"memory": {
"classification": "confidential",
"enforce_read_governance": true,
"scopes": {
"global": { "classification_required": "public" },
"shared": { "classification_required": "internal" },
"user": { "classification_required": "confidential" }
},
"deny_secrets_in_memory": true,
"deny_pii_in_memory": true
},
"cost": {
"budget": {
"daily": 100.00,
"action_on_exceed": "DENY",
"alert_threshold": 0.7
},
"per_request_limit": 5.00,
"action_on_exceed": "REQUIRE_APPROVAL"
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 3,
"reset_timeout_ms": 60000,
"half_open_max_attempts": 1
},
"retry": {
"max_retries": 2,
"backoff": "exponential",
"max_backoff_ms": 3000,
"action_on_exhausted": "DENY"
}
},
"audit": {
"enabled": true,
"log_decisions": true,
"log_evidence": true,
"redact_pii": true,
"redaction_method": "HASH",
"retention_days": 3650,
"export_format": "SARIF",
"include_correlation_ids": true,
"include_risk_scores": true,
"human_oversight": {
"enabled": true,
"require_approval_above_risk": 0.7,
"action_on_no_approval": "DENY"
}
}
}
policy = {
"guard": {
"prompt_injection": {
"enabled": True,
"sensitivity": "high",
"action": "DENY",
"log_attempts": True,
},
"pii_detection": {
"enabled": True,
"action": "REDACT",
"patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD", "ADDRESS", "DOB", "NAME"],
"redact_in_logs": True,
},
"content_moderation": {
"enabled": True,
"threshold": 0.5,
"categories": ["hate", "violence", "sexual", "self_harm", "harassment", "dangerous_content"],
"action": "DENY",
},
},
"secrets": {
"enabled": True,
"confidence_threshold": 0.8,
"categories": ["api_keys", "tokens", "passwords", "cloud_secrets"],
"actions": {"critical": "DENY", "high": "DENY", "medium": "DENY"},
},
"registry": {
"models": ["gpt-4o", "claude-3-5-sonnet"],
"strict": True,
"tools": [],
"deny_unlisted": True,
"verify_provenance": True,
"require_hash": True,
},
"memory": {
"classification": "confidential",
"enforce_read_governance": True,
"scopes": {
"global": {"classification_required": "public"},
"shared": {"classification_required": "internal"},
"user": {"classification_required": "confidential"},
},
"deny_secrets_in_memory": True,
"deny_pii_in_memory": True,
},
"cost": {
"budget": {"daily": 100.00, "action_on_exceed": "DENY", "alert_threshold": 0.7},
"per_request_limit": 5.00,
"action_on_exceed": "REQUIRE_APPROVAL",
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 3,
"reset_timeout_ms": 60000,
"half_open_max_attempts": 1,
},
"retry": {
"max_retries": 2,
"backoff": "exponential",
"max_backoff_ms": 3000,
"action_on_exhausted": "DENY",
},
},
"audit": {
"enabled": True,
"log_decisions": True,
"log_evidence": True,
"redact_pii": True,
"redaction_method": "HASH",
"retention_days": 3650,
"export_format": "SARIF",
"include_correlation_ids": True,
"include_risk_scores": True,
"human_oversight": {
"enabled": True,
"require_approval_above_risk": 0.7,
"action_on_no_approval": "DENY",
},
},
}
EU AI Act Article Mapping
| Article | Requirement | TealEngine Coverage |
|---|---|---|
| Art. 9 | Risk Management | audit.include_risk_scores — risk scoring on every decision |
| Art. 11 | Technical Documentation | audit — SARIF export with full evidence |
| Art. 12 | Record-Keeping | audit.retention_days: 3650 — 10-year retention |
| Art. 13 | Transparency | audit.log_evidence — full decision reasoning |
| Art. 14 | Human Oversight | audit.human_oversight — approval gate above 0.7 risk |
| Art. 15 | Accuracy & Robustness | reliability — circuit breaker + retry |
| Art. 17 | Quality Management | registry.verify_provenance — model integrity |
Install
# Install the EU AI Act compliance pack
tealtiger policy install --pack eu-ai-act-high-risk
# Or copy the JSON above into your tealtiger.config.json
Customize
| Setting | Default | Adjust For |
|---|---|---|
audit.human_oversight.require_approval_above_risk | 0.7 | Lower for stricter oversight, raise for more autonomy |
registry.models | 2 models | Add approved models for your system |
registry.tools | [] (empty) | Add tools your agent needs — start empty and add explicitly |
audit.retention_days | 3650 (10 years) | Match your organization’s retention policy |
The EU AI Act requires a conformity assessment for high-risk AI systems. This policy pack addresses technical requirements but does not replace the full conformity assessment process. Consult with legal counsel familiar with EU AI Act compliance.
Related
- OWASP ASI Starter — Security-focused baseline
- HIPAA Healthcare — Healthcare-specific compliance
- Provenance Verification — Standalone model integrity policy
- TealAudit Documentation — Full audit API reference