Policy Templates

Pre-built governance policies mapped to actual compliance frameworks. Load a template and get enforcement that satisfies auditors — not generic guardrails.

How templates work

Templates define what to enforce at the tool-call boundary. They work with every framework TealTiger supports:

# Strands
TealTigerIntervention(preset="aml-kyc")

# Haystack
TealTigerGovernanceComponent(preset="hipaa-agent")

# AG2
TealTigerMiddleware(preset="soc2-agent")

# LangChain
TealTigerMiddleware(preset="ediscovery")

Each template is a YAML file mapping specific regulatory controls to TealTiger features:

slug: "soc2-agent"
name: "SOC 2 Agent Governance"
industry: "base"
mode: ENFORCE
policies:
  - type: tool_allowlist       # → CC6.1 (Least privilege)
  - type: pii_block            # → CC6.6 (Data protection)
  - type: secret_detection     # → CC6.6 (Credential protection)
  - type: cost_limit           # → CC7.2 (Resource monitoring)
  - type: prompt_injection_block  # → CC8.1 (Change management)

Template catalog

Base (cross-industry foundations)

Template	Regulation	What it enforces
`zero-config`	None	Observe-only telemetry — PII detection, cost tracking, no blocking
`soc2-agent`	SOC 2 Type II (AICPA TSC)	Access control (CC6), monitoring (CC7), change traceability (CC8)
`iso27001-agent`	ISO 27001:2022	Information security management controls
`gdpr-agent`	EU GDPR	Purpose limitation, data minimization, processing records
`eu-ai-act`	EU AI Act 2024	Human oversight for high-risk AI, audit-first decisions

Financial services

Template	Regulation	What it enforces
`aml-kyc`	BSA, FinCEN, FATF, AMLD6	Sanctions screening governance, human-in-the-loop for SAR filing, customer data protection
`m-and-a`	SEC Reg FD, NDA, Clean Room	Deal boundary enforcement, MNPI leak prevention, VDR read-only access
`trading-compliance`	Reg FD, MiFID II	Chinese wall enforcement, insider trading prevention
`financial-data-api`	Data licensing	API cost caps, redistribution prevention
`payment-processing`	PCI-DSS v4.0	Cardholder data protection, scope limitation

Healthcare

Template	Regulation	What it enforces
`hipaa-agent`	HIPAA Privacy/Security Rule	All 18 PHI identifiers, minimum necessary, audit controls
`clinical-research`	21 CFR Part 11, GCP	IRB consent boundaries, data integrity
`health-data-exchange`	FHIR, HL7, TEFCA	Health information exchange governance

Legal

Template	Regulation	What it enforces
`ediscovery`	FRCP, FRE 901	Chain of custody, privilege protection, read-only evidence
`contract-review`	NDA, privilege	Confidentiality boundaries, document isolation
`litigation-support`	Work Product Doctrine	FRCP 26(b)(3) protection, counsel-directed evidence

Government

Template	Regulation	What it enforces
`fedramp-agent`	FedRAMP, NIST 800-53	AC-6 least privilege, AU-2 audit events, SI-10 input validation
`classified-data`	CUI, ITAR, EAR	Export control boundaries, classification enforcement
`public-records`	FOIA	Public records handling, redaction requirements

Technology

Template	Regulation	What it enforces
`code-agent`	OWASP, CWE, NIST SSDF	Secret detection, destructive operation blocking, file access control
`devops-agent`	SOC 2 CC8.1	Infrastructure change governance, deployment safety
`customer-support`	GDPR, CCPA	PII handling in support tickets, escalation rules

Regulatory control mapping

Each template includes a mapping table showing exactly which TealTiger feature satisfies which compliance control. Example — SOC 2:

TealTiger Feature	SOC 2 Control	Description
Tool allowlist	CC6.1	Least privilege access
PII/secret detection	CC6.6	Data protection
Cost tracking	CC7.2	Resource monitoring
Budget ceiling	CC7.2	Anomaly response
Injection defense	CC8.1	Change management
Audit trail	CC7.2 + CC8.1	Monitoring + traceability
Kill switch	CC7.3	Incident response

Example — HIPAA:

TealTiger Feature	HIPAA Control	Description
Tool allowlist	164.312(a)	Access control
PHI detection (18 IDs)	164.312(c)	Integrity
Secret detection	164.312(a)	Authentication
Injection defense	164.312(c)	Integrity
Audit trail	164.312(b)	Audit controls
Cost limit	164.502(b)	Minimum necessary
Kill switch	164.308(a)(6)	Incident handling

Composing templates

Templates are composable. Use a base + an industry template for layered governance:

# SOC 2 foundation + AML/KYC industry rules
TealTigerIntervention(preset=["soc2-agent", "financial-services/aml-kyc"])

# GDPR foundation + Healthcare industry rules
TealTigerIntervention(preset=["gdpr-agent", "healthcare/hipaa-agent"])

When composed, the most restrictive policy wins for each check type.

Custom overrides

Extend any template without forking:

TealTigerIntervention(
    preset="aml-kyc",
    overrides={
        "budget_limit": 25.0,           # Override default
        "allowed_tools": ["screen_*"],   # Narrow the allowlist
    }
)

What templates produce

Every template generates the same audit evidence:

GovernanceDecision per tool call — action, reason codes, risk score, latency
TEEC receipts — tamper-evident execution records with correlation IDs
Cost tracking — cumulative session spend attributed per tool
Deny records — prove unauthorized actions were blocked (auditor evidence)

This evidence maps directly to compliance framework requirements — SOC 2 observation period evidence, HIPAA audit controls, GDPR processing records, FedRAMP continuous monitoring.

Source

All templates are open source (Apache 2.0) and available in the repository: packages/tealtiger-python/src/tealtiger/templates/ Contributions welcome — especially from compliance professionals who can validate regulatory mappings.

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

How templates work

Template catalog

Base (cross-industry foundations)

Financial services

Healthcare

Legal

Government

Technology

Regulatory control mapping

Composing templates

Custom overrides

What templates produce

Source

​How templates work

​Template catalog

​Base (cross-industry foundations)

​Financial services

​Healthcare

​Legal

​Government

​Technology

​Regulatory control mapping

​Composing templates

​Custom overrides

​What templates produce

​Source

How templates work

Template catalog

Base (cross-industry foundations)

Financial services

Healthcare

Legal

Government

Technology

Regulatory control mapping

Composing templates

Custom overrides

What templates produce

Source