Policy management

The policy library

Open Policy Library from the sidebar. You see every policy in the tenant with its status (Draft, Review, Active, Archived), owner, last review date, and the frameworks it covers.

Filter by status, category, or framework. Click any policy to open the editor, which shows the current version alongside metadata, version history, and acknowledgment tracking.

AI-drafted policies

Click New Policy, pick a category (Access Control, Data Classification, Incident Response, Acceptable Use, Vendor Management, etc.), and pick the frameworks it should satisfy. Radius360 drafts a full policy using the conventions of those frameworks.

1. 1
   Pick the category and frameworks. The AI uses these to decide structure, terminology, and which controls the policy must address.
2. 2
   Add context. Optional prompt box for anything specific to the client (industry, data handled, regulatory overlays, cultural quirks like "we do not allow personal devices").
3. 3
   Review the draft. Radius360 generates the policy in seconds. Read it. Edit inline. The draft follows the structure auditors expect: Purpose, Scope, Policy Statements, Roles and Responsibilities, Enforcement, Review Cycle.
4. 4
   Save. The policy enters the library as a Draft. You can keep iterating or move it to Review and then Active.

Importing existing policies

If the client already has policies they want to keep, use Import. Upload Word, PDF, or Markdown. Radius360 parses the document, extracts which controls it addresses, and offers a suggested category and framework mapping.

Review the suggested mapping. Save. The policy lives in the library alongside the AI-drafted and manually-written ones.

Version history

Every change is tracked. Open a policy, click Versions in the sidebar of the editor, and you see every saved revision with timestamp, author, and a summary of what changed. Click any version to view it. Click Compare to see a side-by-side diff between any two versions.

To roll back, open the version you want, click Restore. The restored version becomes the new current version; nothing in the history is deleted.

Publishing and acknowledgments

Move a policy to Active to publish it. Active policies are visible to everyone in the tenant who has access. You can require explicit acknowledgment from a group of users (all staff, just admins, just new hires, etc.) and Radius360 tracks who has and has not acknowledged.

The Outstanding Acknowledgments dashboard shows who still needs to read a policy and when their grace period expires. Export this list for audit evidence or for sending reminders.

Framework mapping

Every policy is mapped to the framework controls it addresses. Radius360 does this automatically during AI drafting and suggests mappings during import. You can edit the mapping manually from the policy editor.

When a policy is mapped to a control, that control is considered "policy-covered" in the framework assessment. You still need evidence that the policy is being followed, but the written policy itself is one of the satisfied requirements.

Evidence-aware policies

For tenants with connected deep integrations, Radius360 can draft policies that reflect the actual configuration of your environment rather than a generic template.

Example: when drafting an Access Control policy for a tenant with Okta connected, the AI reads your actual MFA enforcement settings, password policy, and privileged-access workflow, and writes the policy to match. If the enforced configuration drifts from what the policy says later, Radius360 flags the drift as a risk.