> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/policies/policies.md).

# Policies

## Policies Overview

The **Policies** page holds the documents that describe how your organization works — security policies, runbooks, and internal docs. It serves two purposes at once:

1. **Grounding Herd AI.** Every document you add becomes part of the corpus Herd AI reads when it generates trainings and answers questions, so generated content reflects *your* rules, not generic ones. A runbook or internal doc belongs here even if nobody ever needs to acknowledge it.
2. **Attestation (optional, per document).** For the documents that *do* need sign-off — an Acceptable Use Policy, an NDA — assign them for acknowledgment. Herd delivers each policy to your users in Slack, or — for users without a linked Slack account — by **email with a secure magic link**, lets them acknowledge it with a single click, and tracks who has and hasn't responded so you always have an audit-ready record.

You can add a policy by uploading a document (**PDF, DOCX, TXT, CSV, or MD/Markdown**) or by pasting an external link. For organizations that keep their policies in Microsoft 365, Herd can also **auto-sync** an entire folder of policy documents from OneDrive or SharePoint, so you no longer have to upload policies one at a time.

**Policies** is a top-level item in the left-hand sidebar — it has its own entry rather than sitting under Compliance. Click **Policies** in the sidebar to open it.

***

## Creating a Policy

### Step 1: Start a new policy

From the Policies page, click **Create Policy** in the top-right corner. (If you don't have any policies yet, you can also use the **Create Policy** button in the center of the empty page.) This opens the **Create Policy** modal, where you provide the document and details without leaving the Policies page.

### Step 2: Add the policy document

Choose how you want to provide the policy:

* **Upload File** — Click or drag a file into the upload area. Supported formats are PDF, DOCX, TXT, CSV, and MD (Markdown), up to 50 MB.
* **External Link** — Paste a URL that points to your policy document (for example, a link to a hosted PDF).

### Step 3: Let Herd auto-fill the details (optional)

When you create a new policy, **Auto-fill from document** is enabled by default. Herd analyzes the document you provided and suggests a policy name, type, and acknowledgement message for you. If you'd rather fill everything in yourself, uncheck **Auto-fill from document** and expand **Policy Details** to enter the fields manually:

* **Policy Name** — The title users will see (for example, *Acceptable Use Policy*).
* **Policy Type** — A category such as Acceptable Use, NDA, Security, Runbook, or Internal doc.
* **Version** — An optional version label (for example, *1.0*).
* **Message to User** — The message Herd sends alongside the policy. The default is "Please review and acknowledge the following policy."
* **Description (Internal)** — A note for admins only; users never see this.

### Step 4: Preview and create

Expand **Preview** to see exactly how the policy message and **I Acknowledge** button will appear to your users in Slack. When you're ready, click **Create Policy**.

{% hint style="info" %}
Once created, you'll land on the policy's detail page, where you can assign it to users and track responses across the **Details**, **Assignments**, and **Reports** tabs.
{% endhint %}

### How policies reach users (delivery channels)

You don't pick a channel — Herd routes each recipient automatically when you click **Send Policy to N User(s)** on the Assignments tab:

* **Slack** — users with a linked Slack account get the policy as a Slack message with an **I Acknowledge** button.
* **Email magic link** — everyone else receives an email containing a secure, single-purpose link. It opens a web page showing the policy name, version, and message, a **View policy document** link, and an **I Acknowledge** button — no login required, and the link identifies the recipient ("Signed in as *their email*"). Acknowledging shows a **Policy Acknowledged** confirmation, and re-opening the link later keeps that state.

Either way, every acknowledgement is recorded with its **delivery channel** for your audit trail.

***

## Auto-Syncing Policies from OneDrive or SharePoint

Instead of uploading policies one at a time, you can point Herd at a folder of policy documents in OneDrive or SharePoint. Herd keeps its local copies in sync automatically, so your policies stay current as you update the source files.

The policy store reuses your existing **Microsoft Entra ID (Azure AD)** connection and accesses the folder **read-only** — Herd never modifies your files. You'll need Microsoft 365 / Azure AD connected before you can set this up.

### Step 1: Open the policy store setup

Go to **Settings → Integrations** and open the **SharePoint & OneDrive** card (in the **Knowledge & Policies** section).

### Step 2: Choose a source and folder

Click **Choose a policy folder**, then select your source:

* **SharePoint** — Search for a site by name, pick its document library, and browse to the folder that holds your policies.
* **OneDrive** — Enter the user (UPN/email) whose OneDrive holds the policies, then browse to the folder.

Use the breadcrumb folder browser to navigate into the right folder, then click **Use this folder**. Herd verifies it can reach the folder before saving, so a bad selection fails right away instead of producing empty syncs.

### Step 3: Sync and monitor

Once connected, Herd syncs the folder automatically on a recurring schedule. You can also trigger an immediate sync at any time with **Sync policies now**. The tile shows the current status, including:

* The connected source and folder path
* When the folder was last synced
* How many policies were found
* How long the last sync took

{% hint style="info" %}
Auto-synced policies appear on the Policies page with a **OneDrive** or **SharePoint** badge, so you can tell at a glance which policies came from your document store versus those you uploaded manually.
{% endhint %}

### Disabling sync

To stop automatic updates, open the policy store tile and click **Disable**. Policies that have already synced are kept — they simply stop updating. You can re-enable syncing later by choosing a folder again.

***

## Managing Your Policies

Back on the Policies page, you can find and organize your policies using the controls at the top of the list:

* **Search** — Find a policy by name.
* **Type filter** — Narrow the list to a specific policy type.
* **Source filter** — Toggle between **All**, **File**, and **Link** policies.
* **Archive filter** — Switch between **Active** (the default), **Archived**, and **All**.
* **Created by** — Filter to policies created by a specific admin.

Each row shows the policy name, version, type, and when it was created. Auto-synced policies are marked with a **OneDrive** or **SharePoint** badge. Hover over a row to **view details**, **edit**, **archive**, or **delete** a policy.

### Archiving a policy

When a policy is superseded, archive it instead of deleting: click the **archive icon** on its row and confirm. An archived policy:

* Is hidden from the active list (find it with the **Archived** filter; it carries an **Archived** badge).
* Can't be assigned to anyone new and stops being delivered — it's also excluded from compliance reports and the summary cards.
* Keeps every acknowledgement on record, and can be restored at any time via the **unarchive icon** on the row.

{% hint style="info" %}
Archiving is blocked while the policy still has unacknowledged assignments — collect or remove those first. Archiving requires the **Policy Manage** permission.
{% endhint %}

Click any policy to open its detail page, which is organized into tabs:

* **Details** — The policy document, message, and metadata.
* **Assignments** — The users and groups this policy is assigned to. A **Nudge All** button at the top of the current assignments list reminds everyone with an outstanding acknowledgement in one action.
* **Reports** — Who has acknowledged the policy and who is still pending.

For an organization-wide view, click **Policy Report** to open the cross-policy report. Five summary cards sit at the top:

* **Total Policies** — How many policies exist across your organization.
* **Assignments** — The total number of policy assignments.
* **Acknowledged** — How many assignments have been acknowledged.
* **Pending** — How many assignments are still outstanding.
* **Acknowledgement Rate** — Your overall acknowledgement percentage.

Below the cards, a searchable, sortable table lists every assignment. Two exports are available:

* **Export CSV** — the report table as a CSV (name, email, policy, status, sent/acknowledged dates).
* **Audit Export** — a one-click, auditor-ready attestation export. Each row is a single attestation with stable IDs, the policy name and version, whether and when it was acknowledged, and the **delivery channel** (Slack or email). It honors the status filter you have applied, so you can export exactly the slice an auditor asks for. This is the same evidence shape Herd pushes to GRC tools like [Drata](/herd-security-docs/compliance/drata-integration.md).