Skip to content
Free Store
Get started
quoxcli

See what is inside a policy pack

Machine verified A machine ran this on our install and checked the result against the CLI. A test report is linked. CLI 0.4.0, checked 2026-11-05.

What would this pack switch on?

Ask which policies are inside a ready-made pack, then read every rule, effect and control mapping yourself.

What you get: the full list of policies a pack would create, what each one blocks, logs or holds for approval, and which compliance controls it maps to, before anything changes in your org.

Ask Quox

Section titled “Ask Quox”

Name the pack and ask in plain words:

quox · talking to Quox

Which individual policies are inside the soc2-starter governance template pack?

▤ AOCL │ L1 identity complete · allowed · 1ms

▤ AOCL │ L3 policy gate complete · proceed · 4ms

◐ DELEGATE │ delegate_to_agent agent_id=auditus ✔ DELEGATE │ delegate_to_agent agent_id=auditus │ 1 tools used, 1 tool outcomes · 20.1s

⛓ AEE │ envelope opened · ops.tool · delegate_to_agent ok

⛓ AEE │ envelope opened · stream_success

I'll hand this to AUDITUS, who holds the governance template reads.

The SOC2 Starter pack ( soc2-starter ) holds 4 policies (source:
governance_get_templates). Confidence: VERIFIED. This is a direct read of the template.

The template does not give the policies individual ids, only names. I won't make up ids.
Policy ids are probably assigned when a pack is applied to the org's policy store.

#         1
Name      SOC2: Require approval for infrastructure changes
Category  governance
Effect    require_approval
Priority  800
Controls  CC6.1, CC8.1

#         2
Name      SOC2: Log all tool executions
Category  compliance
Effect    log_only
Priority  300
Controls  CC7.2

#         3
Name      SOC2: Block credential exposure
Category  safety
Effect    deny
Priority  900
Controls  CC6.1, CC6.7

#         4
Name      SOC2: Rate limit per org
Category  execution
Effect    deny
Priority  600
Controls  CC6.1

The numbers in the first column are only the order the template lists the policies in.
They are not ids.

What each policy does:

• Infrastructure changes: stop, reboot, shutdown, remove, delete and kill actions
  through  proxmox_vm_action ,  docker_fleet_container_action  or  ssh_exec  need
  approval first.
• Tool logging: every tool execution is logged for audit.
• Credential exposure: queries that contain  password= ,  secret:  or  api_key= 
  patterns are denied, and so is any data flagged as containing personal data (PII).
• Rate limit: queries are denied once the org goes over 500 per hour.

If you need real policy ids, I can list the org's live policies and check whether this
pack has already been applied.

Tools used: governance_get_templates

28.4s · 1 tool · 0 approvals

A real turn on our own install (CLI 0.4.0, 3 Nov 2026), replayed at speed. Names changed. Type the same words into quox.
✔ Machine verified against the CLI on 3 Nov 2026 · test report mvzydm

AUDITUS read the pack definition and listed its four policies, with the effect, priority and SOC 2 controls for each. It also said why the policies have no ids yet: a pack is a template, and ids are only given when its policies are created in your org.

Do it yourself

Section titled “Do it yourself”

1. Read the pack

Section titled “1. Read the pack”
pack 
quox governance template show soc2-starterTemplate Pack: soc2-starter─────────────────────────────────────id            soc2-startername          SOC2 Starterdescription   Baseline policies for SOC2 Type II compliance. Covers acc...policies  - name: SOC2: Require approval for infrastructure changes    category: governance    priority: 800    conditions:      operator: AND      conditions:        - field: tool.name          operator: in          value: proxmox_vm_action, docker_fleet_container_action, ssh_exec        - field: tool.action          operator: in          value: stop, reboot, shutdown, remove, delete, kill    effect: require_approval    reason: SOC2 CC6.1: Infrastructure changes require approval    framework_mapping: soc2.cc6.1, soc2.cc8.1    audit_required: yes
From a real run on our own install. The first policy is shown in full; the other three follow the same shape and are left out.

Each policy gives its conditions (what it matches), its effect (deny, require_approval or log_only), a priority (higher wins when two policies match) and the framework_mapping to the controls it supports.

2. Compare it with the other packs

Section titled “2. Compare it with the other packs”

quox governance template list shows every pack with a short description and how many policies it holds. Run show on any of them the same way.

3. Check it against what you already have

Section titled “3. Check it against what you already have”
Terminal window
quox governance template conflicts soc2-starter

This tells you where the pack would clash with policies already in your org. It only reads.

What just happened

Section titled “What just happened”

Quox read the pack’s definition. A pack is a template, so reading it changes nothing in your org and needs no approval. The policies only exist in your org once someone runs quox governance template enable soc2-starter.

Next

Section titled “Next”