Policy packs

Packs are versioned SQL that call pg_policy.upsert_policy. They are the supported way to onboard a domain without inventing APL from scratch.

Load

psql "$DATABASE_URL" -f examples/packs/00-baseline.sql
psql "$DATABASE_URL" -f examples/packs/analytics.sql   # pick one domain

Order: baseline first, then one or more domain packs. Packs do not set enforcement_mode.

Catalog

File Intent
00-baseline.sql Universal: no DDL/admin SQL, SQL guidance, conservative export quota
analytics.sql Text-to-SQL BI agents
support.sql CX copilots, PII, refunds
fintech.sql Attribution + transfer/export brakes
healthcare.sql PHI export ban + acting_for
devops.sql DBA/IDE agents: EXPLAIN yes, live DDL no
multi-agent.sql Per-role tool matrix

Customize

  1. Copy a pack.
  2. Replace "*" principals with your principal_ids.
  3. Adjust temporal thresholds.
  4. Keep names stable (pack_baseline_ddl, …) so upserts update in place.

Tests

After load, run the pack’s trailing SELECT evaluate(...) comments as smoke tests, or use examples/01-*.sql patterns.