Draft policies with AI
Describe a compliance rule in plain language and get a validated policy draft to review in the Governance wizard.
Writing a compliance policy from scratch means knowing the exact syntax for each resource. Describe the rule you want instead, and the AI assistant drafts the policy for you to review. It never saves anything by itself.
Start a draft
There are two ways to begin:
- In the policy wizard (Accounts → Governance → Policies → Create Policy), click Draft with AI on the General step. The assistant opens in a new chat ready to draft a policy.
- Type
/create-policyin any chat, followed by your description, for example/create-policy Require encryption at rest for all S3 buckets.
You can also describe a host check, for example that SSH root login is disabled on your Ubuntu hosts.
What the draft contains
The assistant decides whether your request is about a cloud resource or a Linux host and drafts exactly one of them.
| Cloud policy | Host policy | |
|---|---|---|
| Providers | AWS and Azure | Linux hosts |
| Definition | A policy written in YAML | A compliance script with its expected output |
| Optional extras | A remediation script, and whether to run it automatically |
Every draft also has a name, description, category and severity (Critical, High, Medium or Low). Where your request matches a known framework such as CIS, NIST, HIPAA, SOC 2, GDPR or ISO, the assistant suggests the matching policy group. If you ask for another cloud, the assistant drafts the policy for AWS and tells you that only AWS and Azure are supported.
When details are missing, the assistant makes reasonable assumptions and drafts anyway, because you review the result before anything is saved.
Validated drafts
For AWS and Azure drafts, the assistant checks the YAML against the Governance policy validator, the same check behind Validate YAML in the wizard. The draft card shows a Validated or Not validated badge; hover Not validated to see why.
Review and use the draft
The draft appears as a card in the chat with its details and definition. Ask for changes in the chat, such as "make it high severity" or "add a remediation script", and the assistant returns an updated draft.
When it looks right, click Use this draft. MCM opens the policy wizard with every field filled in. Review it, Validate YAML if you like, and save it the same way as any other policy. If you never click Use this draft, nothing in Governance changes.
Always read an AI-generated policy and any remediation script before you activate it. See Governance.
An AI provider must be connected first. See AI provider setup.