AI Skill Report Card
Governing Policy Compliance
Quick Start14 / 15
Given a policy set and a target (config, document, action, or system state), produce three outputs:
- Policy Report — which rules were checked and their pass/fail status
- Violation Report — details of every failure, with severity and evidence
- Recommendation — concrete remediation steps, prioritized
Input: Deployment config + "No secrets in plaintext" policy
Output:
Policy Report: 1 rule checked → FAIL
Violation Report: `db_password` found in plaintext at config.yaml:12 (Severity: Critical)
Recommendation: Move secret to environment variable / secrets manager; rotate credential.
Recommendation▾
Add an example showing a NEEDS-REVIEW case fully worked through end-to-end
Workflow14 / 15
Progress:
- Step 1: Identify applicable policies/governance rules for the target (explicit rules given, or infer standard categories: security, data privacy, access control, operational, compliance/regulatory)
- Step 2: Parse the target artifact (config, document, process, decision) into checkable units
- Step 3: Evaluate each unit against each rule — mark PASS / FAIL / NOT-APPLICABLE / NEEDS-REVIEW
- Step 4: For each FAIL, capture evidence (exact location/quote/value), assign severity (Critical / High / Medium / Low)
- Step 5: Draft prioritized, actionable recommendations tied 1:1 to violations
- Step 6: Assemble the three-part output (Policy Report, Violation Report, Recommendation)
Recommendation▾
Include guidance for handling conflicting or overlapping policies
Report Format
Policy Report
| Rule ID | Rule Description | Status |
|---------|--------------------------|---------|
| P-001 | No plaintext secrets | FAIL |
| P-002 | MFA required for admin | PASS |
| P-003 | Data retention ≤ 90 days | NEEDS REVIEW |
Violation Report
Violation: P-001 — Plaintext secret detected
Location: config.yaml:12
Evidence: `db_password: "hunter2"`
Severity: Critical
Impact: Credential exposure if repo/config leaks
Recommendation
1. [Critical] Move db_password to secrets manager; rotate immediately.
2. [Medium] Clarify data retention policy owner before final ruling on P-003.
Examples16 / 20
Example 1: Input: A vendor contract clause "Data may be stored indefinitely" checked against policy "Data retention must not exceed 24 months." Output:
- Policy Report: 1 rule → FAIL
- Violation Report: Clause 4.2 contradicts retention policy (Severity: High, contractual/regulatory risk)
- Recommendation: Request contract amendment capping retention at 24 months; escalate to legal if vendor refuses.
Example 2: Input: Access control policy "Admin actions require MFA" checked against an IAM config with MFA enforced for all admin roles. Output:
- Policy Report: 1 rule → PASS
- Violation Report: None
- Recommendation: No action; recommend periodic re-audit (quarterly).
Recommendation▾
Add a pitfall/example for false positives (over-flagging benign configs)
Best Practices
- Always cite exact evidence (file, line, field, quote) — never assert a violation without a locatable source.
- Use consistent severity definitions: Critical (immediate risk/breach potential), High (significant exposure), Medium (process gap), Low (cosmetic/documentation).
- Mark ambiguous cases as NEEDS REVIEW rather than forcing a PASS/FAIL — flag for human judgment.
- Tie every recommendation directly to a specific violation ID; no orphan advice.
- When no explicit policy is given, state assumed baseline standards before evaluating.
Common Pitfalls
- Don't merge the three report sections — keep Policy Report, Violation Report, and Recommendation clearly separated.
- Don't assign severity based on intuition alone; justify it with impact/likelihood reasoning.
- Don't silently skip a rule — every rule must appear in the Policy Report with a status, including N/A.
- Don't recommend vague fixes ("improve security") — always give a specific, actionable step.