Policies

A Policy is an organization-scoped rule, standard, or constraint that gives teams governance context for the work represented in Catalio.

What a Policy Is

Requirements describe what a system should do. Policies describe the constraints that work should follow.

Policies can cover security, compliance, governance rules, technical standards, processes, performance, accessibility, scalability, or operations. Keep the content focused on the rule and the evidence someone would use to understand whether a requirement follows it.

Policy ownership is a Team relationship. Catalio assigns the creating team as owner, so create the policy from the team that should maintain it. Use the description to name a human point of contact when readers need one.

Create and Link Policies

Create a policy with the smallest useful set of information:

• Name: A specific, recognizable title
• Description: Purpose, scope, and point of contact
• Policy type: The kind of governance concern
• Enforcement level: Mandatory, recommended, or optional
• Policy content: The actual constraint or standard
• Effective and review dates: When the policy applies and when it should be reviewed
• AI access: Whether Catalio’s AI may analyze the policy

Visibility controls whether the policy is private, explicitly shared, or available internally.

Link a Policy to a Requirement

A policy becomes part of requirement traceability through a RequirementPolicy link. The link records the policy, the requirement, when it was applied, and an optional rationale explaining why the policy applies.

Write the rationale for this requirement, not as a copy of the policy.

Good rationale

This requirement exports personal data for EU residents. It links to the Data Portability policy because the export must be structured and machine-readable.

Weak rationale

This policy applies because compliance is important.

The good rationale identifies the behavior and the relevant constraint. The weak rationale gives a future reviewer no usable context.

Extract, Understand, Evolve

Extract

Capture policies alongside the system context they govern. Existing policy text can be recorded as policy content, then linked to the requirements it constrains.

Understand

Policy links make compliance gaps visible as missing or unclear governance context. A sensitive requirement with no relevant policy link may need review; an unlinked policy may be obsolete or simply not connected yet. A gap is a prompt for human review, not proof of non-compliance.

When AI access is enabled, Catalio can assist with policy summaries and tags. Teams remain responsible for policy content, applicability, and rationale.

Evolve

Use review dates and ownership to keep policies current as regulations, architecture, and business expectations change. Update the policy once, then review its linked requirements for impact.

Best Practices

1. Name the constraint precisely and keep one clear scope per policy.
2. Create the policy from the team that should own it over time.
3. Choose the enforcement level deliberately instead of relying on the default.
4. Add a requirement-specific rationale to every meaningful link.
5. Set a review date and update or archive policies when they stop reflecting current practice.

Common Pitfalls

1. Writing a feature request as a policy. “Build a profile page” is a requirement, not a constraint.
2. Using vague content such as “follow security best practices” with no actionable standard.
3. Marking every policy mandatory, which removes useful distinction between obligations and advice.
4. Copying policy text into the link rationale instead of explaining why it applies.
5. Creating overlapping policies that leave teams unsure which standard is authoritative.

Next Steps

• Review Requirements to structure the work policies constrain.
• Review Teams before deciding which team should create and own a policy.
• Read The Living Specification for the broader traceability model.
• Use Gap Analysis to compare current and target behavior.

Support

Need help shaping or organizing policies? Contact support@catalio.ai.