Skip to main content
Back to Guides & Cookbooks
Cookbook

How to write compliance policies in natural language

Describe what you need in plain English. Cadreen interprets your policy, creates enforcement rules, and applies them across every tool call.

1

Write your policy in plain English

Cadreen's governance engine interprets natural language policies. Describe what should be allowed, what needs approval, and what should be blocked. The system translates your words into enforcement rules.

GDPR-style

PII access requires DPO approval. Data deletion requests must be honored within 30 days. Cross-border data transfers are blocked by default.

HIPAA-style

PHI access requires approval and logging. Automatic redaction in responses. Full audit trail for compliance reviews.

PCI-DSS-style

Cardholder data must never appear in responses. Financial tool invocations are logged and redacted. Access restricted to authorized roles.

2

Create the policy

TypeScript
const policy = await cadreen.policies.create({
policy_text: "PII access requires DPO approval. Data deletion requests honored within 30 days.",
risk_level: "high",
});

console.log(policy.id); // "pol_a1b2c3"
console.log(policy.status); // "active"
Python
policy = await cadreen.policies.create(
policy_text="PHI access requires approval and logging. Automatic redaction in responses.",
risk_level="high",
)

print(policy.id) # "pol_a1b2c3"
curl
curl -X POST https://accomplishanything.today/api/v1/cadreen/policies \
-H "Authorization: Bearer sk_cadreen_..." \
-H "Content-Type: application/json" \
-d '{
"policy_text": "Cardholder data must never appear in responses.",
"risk_level": "high"
}'
Note
Cadreen uses an LLM to interpret your policy text and create structured enforcement rules. Be specific about what should be allowed, blocked, or require approval.
3

See it enforced across surfaces

opencode — PII access blocked
> Look up customer john@example.com's credit card number

I can't do that. Your workspace has a policy that blocks cardholder data.

If you need access, say "request access" and I'll escalate to your DPO.
SDK — governance decision
const result = await cadreen.intent.invoke({
messages: [{ role: "user", content: "Show me all PII for user 123" }],
});

console.log(result.type); // "blocked"
console.log(result.reason); // "Policy requires DPO approval for PII access"
Note
Every governance decision is logged with full context. You can query it from any surface for compliance reviews.
4

Audit trail for compliance reviews

Every governance decision is logged with full context. Query from any surface for compliance reviews. The audit trail is tamper-proof — every entry is hash-chained.

CLI — compliance audit
$ cadreen traces --decision blocked

Found 12 blocked requests (last 30 days):

2026-06-21 PII access blocked user:456 DPO approval requested
2026-06-20 PII access blocked user:789 DPO approved (2h response)
2026-06-18 Cross-transfer blocked user:123 No approval requested
Note
The audit log records every action with hash-chain integrity. Verify it with: GET /api/v1/cadreen/audit/verify.