Policy JSON
{
"guard": {
"prompt_injection": {
"enabled": true,
"sensitivity": "medium",
"action": "DENY",
"log_attempts": true
},
"pii_detection": {
"enabled": true,
"action": "REDACT",
"patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD"],
"redact_in_logs": true
}
},
"secrets": {
"enabled": true,
"confidence_threshold": 0.8,
"categories": ["api_keys", "tokens", "passwords"],
"actions": {
"critical": "DENY",
"high": "DENY",
"medium": "REDACT"
},
"credential_ttl": {
"enabled": true,
"max_age_days": 90,
"warning_days": 75,
"action_on_expired": "DENY",
"action_on_warning": "REQUIRE_APPROVAL"
}
},
"registry": {
"models": ["gpt-4o", "gpt-4o-mini", "claude-3-sonnet", "claude-3-5-sonnet"],
"strict": true,
"tools": ["web_search", "file_read", "database_query"],
"deny_unlisted": true,
"verify_provenance": true,
"require_hash": false
},
"memory": {
"default_scope": "session",
"allowed_scopes": ["request", "session", "user"],
"classification": "internal",
"enforce_read_governance": true,
"deny_secrets_in_memory": true
},
"cost": {
"budget": {
"daily": 50.00,
"action_on_exceed": "DENY",
"alert_threshold": 0.8
}
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 5,
"reset_timeout_ms": 30000,
"half_open_max_attempts": 1
},
"retry": {
"max_retries": 3,
"backoff": "exponential",
"max_backoff_ms": 5000,
"action_on_exhausted": "DENY"
}
},
"audit": {
"enabled": true,
"log_decisions": true,
"log_evidence": true,
"redact_pii": true,
"retention_days": 365,
"export_format": "JSON",
"include_correlation_ids": true
}
}
policy = {
"guard": {
"prompt_injection": {
"enabled": True,
"sensitivity": "medium",
"action": "DENY",
"log_attempts": True,
},
"pii_detection": {
"enabled": True,
"action": "REDACT",
"patterns": ["EMAIL", "PHONE", "SSN", "CREDIT_CARD"],
"redact_in_logs": True,
},
},
"secrets": {
"enabled": True,
"confidence_threshold": 0.8,
"categories": ["api_keys", "tokens", "passwords"],
"actions": {"critical": "DENY", "high": "DENY", "medium": "REDACT"},
"credential_ttl": {
"enabled": True,
"max_age_days": 90,
"warning_days": 75,
"action_on_expired": "DENY",
"action_on_warning": "REQUIRE_APPROVAL",
},
},
"registry": {
"models": ["gpt-4o", "gpt-4o-mini", "claude-3-sonnet", "claude-3-5-sonnet"],
"strict": True,
"tools": ["web_search", "file_read", "database_query"],
"deny_unlisted": True,
"verify_provenance": True,
"require_hash": False,
},
"memory": {
"default_scope": "session",
"allowed_scopes": ["request", "session", "user"],
"classification": "internal",
"enforce_read_governance": True,
"deny_secrets_in_memory": True,
},
"cost": {
"budget": {"daily": 50.00, "action_on_exceed": "DENY", "alert_threshold": 0.8},
},
"reliability": {
"circuit_breaker": {
"failure_threshold": 5,
"reset_timeout_ms": 30000,
"half_open_max_attempts": 1,
},
"retry": {
"max_retries": 3,
"backoff": "exponential",
"max_backoff_ms": 5000,
"action_on_exhausted": "DENY",
},
},
"audit": {
"enabled": True,
"log_decisions": True,
"log_evidence": True,
"redact_pii": True,
"retention_days": 365,
"export_format": "JSON",
"include_correlation_ids": True,
},
}
SOC 2 Control Mapping
| SOC 2 Criteria | Description | TealEngine Coverage |
|---|---|---|
| CC6.1 | Logical Access Security | registry — model/tool allowlists, strict mode |
| CC6.2 | Access Provisioning | registry.deny_unlisted — deny-by-default |
| CC6.3 | Access Removal | secrets.credential_ttl — 90-day rotation |
| CC7.1 | System Monitoring | audit — full decision and evidence logging |
| CC7.2 | Anomaly Detection | cost.alert_threshold — budget alerts at 80% |
| CC7.3 | Incident Response | audit.include_correlation_ids — trace requests |
| CC8.1 | Change Management | registry.verify_provenance — model version tracking |
Install
# Install the SOC 2 compliance pack
tealtiger policy install --pack soc2-basic
# Or copy the JSON above into your tealtiger.config.json
Customize
| Setting | Default | Adjust For |
|---|---|---|
secrets.credential_ttl.max_age_days | 90 | Match your organization’s rotation policy |
registry.tools | 3 tools | Add tools your agent needs |
audit.retention_days | 365 | Increase for longer audit periods |
cost.budget.daily | 50.00 | Match your budget |
Related
- OWASP ASI Starter — Security-focused baseline
- Credential Rotation — 90 Day — Standalone rotation policy
- Tool Allowlist — Basic — Standalone tool control
- TealAudit Documentation — Full audit API reference