MCM-48 — Draft a Policy from a Natural-Language Description

← Back to AI-Based Policy Creation overview

As an Enterprise Admin,
I want to describe the compliance rule I want in plain English to the AI assistant and get back a complete draft,
so that I don't have to hand-write a cloud policy definition or host compliance script myself, while I still create the policy myself.

Acceptance Criteria

• The Admin can ask the assistant, in a normal chat message, to draft a policy (for example, "create a policy that flags S3 buckets without encryption enabled" or "check that SSH root login is disabled on our Ubuntu hosts") without leaving the existing chat interface.
• Depending on whether the description targets a cloud resource or a host, the assistant drafts either a cloud policy definition (for the relevant cloud provider) or a host compliance check with its expected output — never both for the same request.
• The assistant's response includes everything needed to create the policy: name, description, category, severity, cloud provider or host OS, and — when the description matches an existing compliance framework or one of its known controls (for example CIS, NIST, HIPAA, SOC 2, GDPR, or ISO) — the matching framework's existing policy group, plus the full definition body.
• The Admin can ask the assistant to change any part of the draft (severity, provider, wording, add a remediation script, and so on) through further conversation, as many times as needed, and the assistant returns an updated draft reflecting the change rather than starting over.
• When a draft looks right, the Admin can prefill it directly into the existing policy creation flow — every field (name, description, category, severity, provider/OS, group, definition body) carries over, so nothing needs to be retyped.
• The assistant itself never creates, updates, or deletes a policy — creating the policy is the same explicit action the Admin already takes in the existing policy creation flow, including its existing validation step, just starting from pre-filled fields instead of blank ones.
• If the Admin doesn't like the draft and never prefills it, nothing else in the product changes — the conversation has no side effects until the Admin acts on it.

---

Technical Design

This extends the platform's existing conversational AI assistant, which today can already look up and summarize existing policies, with the ability to draft a full policy definition and its metadata from a natural-language description, refining it over further turns in the same conversation. It never calls a create, update, or delete action itself; when the Admin accepts a draft, its fields are handed to the existing policy creation flow to prefill, and the Admin proceeds through that flow's own review and validation exactly as if they had typed it by hand. Classification suggestions draw on the compliance framework groups already bootstrapped for every tenant (CIS, NIST, ISO, HIPAA, SOC 2, GDPR).

---

UI / Frontend Changes

• Assistant messages render the draft as a structured card (fields plus the definition body), not plain text or raw YAML in a chat bubble.
• A "Use this draft" action on the card that opens the existing policy creation flow with every field pre-populated from the draft.
• No changes to the policy creation flow's own steps, validation, or create action — it behaves exactly as it does when started manually.