Policy Update

Policy Update delivers a redline diff set for a policy change: the current vs proposed document, a reconciled control mapping, and cited findings — governed by a maker–checker lifecycle so nothing is accepted without a second signer.

When to use it

A policy or guideline is changing and you need a defensible record of what changed, how significant each change is, and who confirmed it.

What the outcome shows

• Current vs proposed documents, each with controls and obligations that carry a citation (document, control, quote).
• Pairing — how current and proposed map together, with a confidence score and a confirmation state.
• Reconciliation — control mappings (matched / added / removed / unresolved) with counts.
• Findings — each classified (editorial, scope changed, obligation added/removed, strengthened/weakened), with a severity, a confidence, and whether it requires human validation.
• Provenance — analysis version and SHA-256 hashes of the sources.

Maker–checker lifecycle

The review moves through pairing review → finding review → owner review, and the gates are enforced:

• Unconfirmed pairings stop at pairing review.
• Any finding that requires human validation stops at finding review.
• Confirming a pairing records the actor’s id and a timestamp — that’s the checker.
• Every citation is validated against the real control text.

What you get

A signed policy diff set with a redline canvas, the change list, and a decision bar — review each finding, confirm the pairing, and approve.