---
title: "Policies"
description: "Create policies in the Policy Library, apply them to projects, and archive applied policies."
source: "Guardian Platform"
---
## About policies

A policy is a structured set of compliance requirements. Policies may represent regulations, RMFs, or internal SOPs.

Policies are made up of two types of components:

- Policy details (name, description, type, etc.)
- Controls (the discrete mandates used to define and measure compliance progress)

Key actions associated with policies include:

- [Creating a policy](#creating-a-policy)
- [Applying a policy](#applying-a-policy)
- [Archiving a policy](#archiving-a-policy)
- [Viewing the Policy Library](#viewing-the-policy-library)

## Creating a policy

Creating a policy lets you define a set of compliance requirements for your project.

There are three ways to create a policy in Guardian:

- **Start Fresh**: Create a new policy from scratch from within Guardian.
- **From Existing Policy**: Create a new policy using an existing policy as a template from within Guardian.
- **Upload Template**: Create a new policy using an Excel template that is downloadable from Guardian.
  - An empty version of this template can be downloaded from the Upload Template flow, or you can export a policy in this template from the Policy Library as described [here](#viewing-the-policy-library).

All three methods achieve the same result: a new policy populates the Policy Library and is ready to apply to a project. Choose the creation method that is most efficient for you — we recommend starting with Upload Template as it offers the most flexibility.

Creating a policy requires the **Create Policies** permission, which only Organization Owners hold. To create a policy:

1. Navigate to the **Policy Library** in the sidebar (**Library** when agent certification is on)
2. Select **Create Policy**
3. Select which method you want to use:
   - **Start Fresh** opens an empty policy
   - **From Existing Policy** lists your policies; select the one to start from
   - **Upload Template** opens **Upload Policy Template**; upload your Excel file, review it, and select **Import Policy**
4. Complete the **Policy Details** step and select **Continue**
5. Complete the **Controls** step, using **Add Control** for each additional control, and select **Continue**
6. Review the policy and select **Create Policy**

![The Create Policy page offering three ways to start: Start Fresh, From Existing Policy with 15 policies available, and Upload Template with a Download Template button.](../../../assets/policies/create-policy-method.png)

When creating a policy, refer to this guide to understand each component:

### Policy Details

- **Policy Name**: The name that identifies your policy within Guardian, up to 200 characters.
- **Version**: A version number for you to track policies with similar attributes. Required, must follow semantic versioning (for example, `1.0.0` or `2.0.0-beta.1`), and the name and version pair must be unique within your organization.
- **Description**: A summary explaining the purpose of your policy.
- **Policy Type**: The category your policy belongs to.
  - **Internal**: Policies that represent your organization's standard operating procedures (SOPs) or similar documents.
  - **Regulatory**: Policies derived from regulations or legislations.
  - **Risk Management**: Policies that represent RMFs from agencies like NIST or those created by industry.
  - **Custom**: Policies that are created for the unique needs of your project or don't fit neatly into a category above.
- **Icon URL**: The icon associated with your policy.

![The Policy Details step of Start Fresh, with Policy Name, Version, Description, and Policy Type filled in for a Model Access Policy, Icon URL left empty, and the Controls and Review steps still to come.](../../../assets/policies/create-policy-details.png)

### Controls

Each control represents a discrete mandate within your policy. You can add as many controls as your policy requires.

- **Title**: A short, descriptive name for the control.
- **Control Code**: A unique identifier for the control, up to 30 characters. Use letters and numbers, with single hyphens or periods between them (for example, `MAP-1.2`). Codes must be unique within the policy, ignoring case.
- **Description**: An explanation of what the control requires.
- **Citations**: Reference sources that support or define the control, up to 20 per control. For each citation, provide:
  - **Citation Source Name**: The title of the cited document, up to 255 characters. If left blank, it is taken from the URL.
  - **Citation Source URL**: A full link to the cited document, starting with `http://` or `https://`, up to 2,048 characters.
  - Select **Add Citation** to add it to the control.

## Applying a policy

Applying a policy to a project activates the policy's controls, enabling your team to start tracking compliance.

Applying a policy requires the **Apply Policies to Projects** permission, held by Organization Owners and Project Owners.

To apply a policy from a project:

1. In the project sidebar, select **Applied Policies**
2. Select **Apply Policy**
3. Select the policy you want to apply
4. Select **Apply Policy**

![The Apply Policy to Project dialog listing library policies with their type and version, a search box, and a Policy Type filter. AI Governance Baseline is marked Already applied and cannot be selected, and Model Access Standard is selected.](../../../assets/policies/apply-policy-dialog.png)

To apply a policy from the Policy Library:

1. Navigate to the **Policy Library** in the sidebar (**Library** when agent certification is on)
2. Select the policy you wish to apply, then select **Apply to Project**. In the library you can instead select **Apply Policy** on the policy's card or row menu.
3. Choose a project
4. Select **Apply Policy**

## Viewing an applied policy

Select an applied policy under **Applied Policies** in the project sidebar to open its pages, listed in the sidebar under **‹ Applied Policies**. The policy's name heads the sidebar; select it to move to another applied policy in the project, on the same page. An archived policy's sidebar reads **‹ Archived Policies** instead, and moves only between archived policies.

- **Overview**: the policy's compliance summary, its details, and its controls table. **Archive Policy** and **Export PDF Report** are here too
- **Controls**: a control's evidence and reviews (see [Declarations and Reviews](./declarations-and-reviews.mdx)); it opens on the policy's first control
- **Monitoring**: the indicators that evaluate the policy's controls (see [Indicators](./indicators.mdx))
- **Evaluation Logs**: the results of those evaluations
- **Certification**: the credentials that certify the policy (see [Credentials](./credentials.mdx))

## Archiving a policy

If an applied policy no longer requires compliance tracking within a project, it can be archived. Archiving a policy prevents any further activity from being recorded in that policy, suspends the policy's controls from contributing to the project's Overall Compliance, disables indicator evaluations from being logged, and revokes active credentials when applicable.

The policy's existing compliance history is preserved for future reference. If the policy needs to be reactivated, it can be reapplied to the project. Reapplying a policy resumes its controls' contribution to compliance. Indicators disabled when the policy was archived stay disabled; activate each again.

To archive an applied policy:

1. In the project sidebar, select the applied policy under **Applied Policies**
2. Select **Archive Policy**
3. Type the applied policy name to confirm
4. Select **Archive**

To reapply an archived policy:

1. In the project sidebar, select **Applied Policies**
2. Select the **Status** filter dropdown and choose **Archived**
3. Select the archived policy
4. Select **Reapply Policy**
5. Type the applied policy name to confirm
6. Select **Reapply**

## Viewing the Policy Library

The **Policy Library** contains all policies available to apply to your project. This page is scoped to your organization and is therefore accessible to Guardian users across all projects. You can navigate to the Policy Library via the sidebar. When agent certification is turned on for your deployment, the sidebar item reads **Library**, and the Policy Library is its **Policies** section, beside [Programs](./governance-programs.mdx).

The Policy Library primarily helps your team understand what policies are available to them and what controls they contain. Use the **Policy Type** filter to narrow the list.

Selecting a policy opens that version. Use the version selector to open another; an earlier version shows a banner with a link to the latest.

The Policy Library also allows users to export a policy in the .xlsx template used in the **Upload Template** policy creation flow. Editing this file in a common spreadsheet editor (such as Google Sheets) is the most efficient way to make significant changes to a policy.

To export a policy:

1. Navigate to the **Policy Library** in the sidebar (**Library** when agent certification is on)
2. Select the policy you wish to export
3. Select **Export Policy**
4. Download the .xlsx file

![The Policy Library in grid view: cards for 21 CFR Part 11, AI Governance Baseline, Data Handling Standard, Model Access Standard, and Retention Custom Policy, each with its type, version, control count, and an Apply Policy button.](../../../assets/policies/policy-library.png)

## Related

- [Controls](./controls.mdx) — how each control's status is tracked once a policy is applied
- [Atomization](./atomization.mdx) — break a regulation or SOP into controls that each state one obligation
- [Projects](./projects.mdx) — the project sidebar where applied policies live
- [Declarations and Reviews](./declarations-and-reviews.mdx) — start building compliance against an applied policy's controls
- [Credentials](./credentials.mdx) — attest that a project has met an applied policy
- [Reports](./reports.mdx) — export an applied policy's compliance record