Skip to content
quoxcli

Pick a starter policy pack

Machine verified A machine ran this on our install and checked the result against the CLI. A test report is linked. CLI 0.3.1, checked 2026-10-17.

Where do I start with policies?

Ask which ready-made policy packs exist and which one fits you. Then compare them and check one before you switch it on.

What you get: a short list of ready-made rule sets, such as a SOC 2 baseline or a strict production set, and a recommendation for your situation.

Ask Quox

Section titled “Ask Quox”

Ask in plain words:

quox · talking to Quox

What governance policy packs could I start from?

▤ AOCL │ L1 identity complete · allowed · 1ms

▤ AOCL │ L3 policy gate complete · proceed · 10ms

◐ DELEGATE │ delegate_to_agent agent_id=auditus ✔ DELEGATE │ delegate_to_agent agent_id=auditus │ 1 tools used, 1 tool outcomes · 23.8s

⛓ AEE │ envelope opened · stream_success

You have five packs to start from. Our governance specialist, AUDITUS, read them from
the live template registry, and nothing has been enabled.

• SOC2 Starter has 4 policies. It is a SOC 2 Type II baseline covering access controls,
  audit logging and change management.
• HIPAA Baseline has 4 policies. It blocks PII transmission, enforces audit trails and
  puts data access behind approval.
• High-Security Production has 5 policies. It adds multi-approval for destructive
  operations, PII blocking, credential protection and tight rate limits.
• Development Sandbox has 3 policies. It warns instead of blocking and has higher rate
  limits and no PII restrictions.
• Blast Radius has 1 policy. It is keyed on what an agent can actually reach, not just
  the tool it named. It needs the reach resolver wired up first, so don't rely on it
  until that's done.

Which to pick: For audit readiness, SOC2 Starter or HIPAA Baseline map directly to those
frameworks. For production, High-Security Production is the stricter choice. Use
Development Sandbox only on dev scopes, alongside a stricter pack on production, because
it only warns.

I can also ask AUDITUS which policies are already active, so you can see what overlaps
with these packs.

37.2s · 1 tool · 0 approvals

A real turn on our own install (CLI 0.3.0, 15 Oct 2026), replayed at speed. Names changed. Type the same words into quox.
✔ Machine verified against the CLI on 15 Oct 2026 · test report mv9rt9

AUDITUS listed the five packs and said which to start with. It also said which parts of its answer it read and which were its own estimate.

Do it yourself

Section titled “Do it yourself”

1. List the packs

Section titled “1. List the packs”
packs 
quox governance template listID                Name                        Description                                                     Policiessoc2-starter      SOC2 Starter                Baseline policies for SOC2 Type II compliance. Covers acc...    4hipaa-baseline    HIPAA Baseline              Policies for HIPAA PHI protection. Blocks PII transmissio...    4high-security     High-Security Production    Strict policies for production environments. Multi-approv...    5dev-sandbox       Development Sandbox         Relaxed policies for development environments. Warns inst...    3blast-radius      Blast Radius                Governance keyed on what an agent can actually reach (BLA...    1
From a real run on our own install.

2. Look inside one, and check it against what you have

Section titled “2. Look inside one, and check it against what you have”
Terminal window
quox governance template show soc2-starter
quox governance template conflicts soc2-starter

show lists the pack’s policies in full. conflicts tells you where the pack would clash with policies you already have, before anything changes.

3. Switch it on

Section titled “3. Switch it on”
Terminal window
quox governance template enable soc2-starter

This creates the pack’s policies in your org. It is a write, so run it yourself once you are happy with what show and conflicts told you.

What just happened

Section titled “What just happened”

Quox only read the list of packs. Nothing is enabled until you run enable.

Next

Section titled “Next”