Policies & acknowledgments
Ask AI
Publish a policy as an immutable version, roll it out to a frozen audience, and keep signature evidence pinned to a SHA-256 fingerprint
A policy is a document people must read and confirm, such as a handbook or a code of conduct. Three objects with different lifetimes: the policy ("Employee handbook"), a version (the exact bytes people were asked about, pinned with a SHA-256 fingerprint), and a rollout (one version sent to one audience with its own due date, called a campaign in the UI).
Policies live under People → Company documents; publishing, campaigns and the Campaigns tab are admin-only.
Publishing a version
New version on a Policy publishes the next version from a new upload. Versions are never edited: publishing leaves the previous version and its signatures untouched, and each version's fingerprint is copied onto every signature against it.
In force since backdates a version - it records when the text took effect, never delays it. A future date is refused with a 400; blank records no effective date.
Rolling it out
Open a policy document, pick a version, then choose Start campaign and an audience: All active employees, One team, or One person. The audience is frozen there - a later joiner is not added, a leaver does not drop out. Over 2,000 people the campaign is refused with a 409; roll a large workspace out team by team.
Asks land in Inbox → Needs action under Documents to sign. A due date, which cannot be in the past, enrols the ask in the nightly overdue digest - reminders at one and three days overdue, then weekly to day 30. An undated ask sends none.
Two campaigns for one version converge on one obligation - the person signs once and both count it. Progress reads three counts: signed, outstanding, no longer required. View roster lists the audience with each person's state; Export signatures downloads it as CSV.
Edit details carries Ask new joiners to sign the current version. It reaches forward only, and its asks carry no due date, so they never reach the digest.
Signing
The person chooses Review & sign and types their full name. The evidence row records that
name, the version's fingerprint, the time, the channel (ui, mcp or api), the caller's IP
address and user agent. A name over 120 characters is refused, never truncated. Only the
obligation's own employee may sign it - anyone else gets a 403, a second signature a 409. This is
acknowledgment capture, not a qualified electronic signature.
Closing and revoking
Closing a campaign is terminal. Signatures stand, and its still-open asks are cancelled unless another open campaign, auto-enrolment or a process run also created them. Closing answers 409 while a process run waits on one of those acknowledgments; cancel the run first.
Revoke signature on the roster deletes the acknowledgment row, reopens the obligation, and writes the full evidence snapshot and the stated reason to the immutable audit log. It works on closed campaigns too.
A process policy acknowledgment action waits until the subject signs, and completes at once when they already signed the active version; a process naming a policy with no published version is refused at publish (Processes).
Worked example
Marta publishes version 2 of Northlake's handbook and starts a campaign for All active employees, due in two weeks; the 15 people active that day freeze into the roster. Tomasz signs from Inbox → Needs action, and his evidence row carries version 2's fingerprint. Aleksandra joins the week after, so only the new-joiner switch asks her.