Governance Policies

A policy is a named group of controls that represents a single compliance requirement — for example, your internal AI standard or an external framework like the EU AI Act or NIST AI RMF. A policy is met only when every control it contains passes.

How policies work

• A policy contains one or more controls.
• Each project belongs to at most one policy. A single policy can govern many projects.
• Every project assigned to a policy is assessed against all of that policy's controls.
• The policy is met for a project only when every control resolves to PASS. Any FAIL, ERROR, or NO_DATA means the policy is not met.

Create a policy

1. Navigate to your organization's Governance page
2. Click New Policy
3. Enter a Name and an optional Description
4. Add the controls this policy should enforce
5. Save the policy

Assign projects

A policy has no effect until projects are assigned to it. From the policy, assign the projects it should govern. Each assigned project is then continuously assessed against the policy's controls.

To move a project to a different policy, simply reassign it — a project always belongs to exactly one policy (or none).

Custom Agent Skills

Governance policies can also define the governance Custom Agent Skill for coding agents. Define the skill once on the policy, and every project assigned to that policy receives the same skills/governance/SKILL.md content from the project-scoped /skills.git endpoint.

Use this to give Claude Code, Codex, Cursor, and other coding agents the same policy-specific instructions your teams are expected to follow. See Standardize Onboarding with Custom Agent Skills for the end-to-end setup.

When assessments run

A project's controls are assessed against its policy:

Each assessment produces a historical record, so you can track how a project's compliance posture changes over time.

Gate deployments on a policy

A policy can act as a deployment gate. The gate assesses every control in the project's policy and only passes if all of them pass.

Run the gate from CI/CD using the deepeval CLI (available in both Python and TypeScript), or call the public API directly:

deepeval gate

npx deepeval gate

curl -X POST "https://api.confident-ai.com/v1/governance/assess" \
  -H "CONFIDENT_API_KEY: <PROJECT-API-KEY>"

The CLI exits with code 0 only when the policy is fully met, and a non-zero code otherwise — so a failing policy stops your pipeline. All three call the POST /v1/governance/assess endpoint with your project's API key. The response tells you whether the policy passed and which policy was evaluated:

{
  "success": true,
  "data": {
    "passed": false,
    "governancePolicy": {
      "id": "GOVERNANCE-POLICY-ID",
      "name": "EU AI Act"
    }
  },
  "deprecated": false
}

Next steps

• Controls — configure the requirements inside your policy
• Custom Agent Skills guide — distribute policy-specific governance instructions to coding agents
• Introduction to AI Governance — how policies, controls, and gating fit together

Last updated on July 27, 2026