AI Policy Statements

AI policy statements are your organization's own commitments, written in your own words, one statement per principle — human oversight, privacy, transparency, accountability and the others in the risk catalog, or a general statement. They are versioned, published by the owner, and attested by the people who read them. A published statement is evidence that a policy exists; the attestation roster is evidence that people saw it.

Lifecycle

Publishing, retiring and attesting are written to the audit trail as compliance.policy.published, compliance.policy.retired and compliance.policy.attested, with the acting user.

Attestation

Any signed-in user can attest to a published statement — attesting is reading. An attestation is pinned to the version the user read: when a published statement's body changes, its version moves on and the roster shows the earlier attestations as such, so a statement that changed after someone attested never silently inherits their name. Attesting twice to the same version records nothing new.

A person who is later removed from your account stays on the roster by the email recorded at the time. An attestation is a record of something that happened.

Mark a statement attestation required to ask every user to read it. The frameworks page counts a published statement as full evidence only when someone has attested to the version in force; a published statement nobody had to read still counts as partial evidence that a policy exists.

From the API

List statements (any role; optional ?status=draft|published|retired):

curl https://api.mitrity.com/api/v1/compliance/policy-statements \
  -H "Authorization: Bearer mk_your-api-key"

Create a draft (manager or owner). The slug is lowercase letters, digits and hyphens and cannot change later; principle names a risk class from the catalog or is omitted for a general statement:

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements \
  -H "Authorization: Bearer mk_your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "slug": "human-oversight",
    "title": "Human oversight of autonomous agents",
    "principle": "human_oversight",
    "body_markdown": "## Human oversight\n\nEvery agent that can act irreversibly runs behind a hold rule with a named approver…",
    "requires_attestation": true
  }'

{
  "id": "1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a",
  "slug": "human-oversight",
  "title": "Human oversight of autonomous agents",
  "principle": "human_oversight",
  "version": 1,
  "status": "draft",
  "requires_attestation": true,
  "published_at": null,
  "created_at": "2026-09-22T08:15:00Z"
}

Edit a statement (manager or owner for a draft; owner for a published one):

curl -X PUT https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a \
  -H "Authorization: Bearer mk_your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"title": "Human oversight of autonomous agents (revised)"}'

Publish (owner):

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/publish \
  -H "Authorization: Bearer mk_your-api-key"

Attest to the version in force (any role):

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/attest \
  -H "Authorization: Bearer mk_your-api-key"

The roster:

curl https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/attestations \
  -H "Authorization: Bearer mk_your-api-key"

{
  "statement_id": "1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a",
  "current_version": 2,
  "current_count": 1,
  "attestations": [
    { "statement_version": 2, "user_email": "ana@example.com", "user_name": "Ana Platform", "attested_at": "2026-09-22T09:00:00Z", "current": true },
    { "statement_version": 1, "user_email": "lee@example.com", "user_name": null, "user_id": null, "attested_at": "2026-09-20T16:40:00Z", "current": false }
  ]
}

Retire (owner):

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/retire \
  -H "Authorization: Bearer mk_your-api-key"

Delete a draft (owner; a published statement is retired instead):

curl -X DELETE https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a \
  -H "Authorization: Bearer mk_your-api-key"

Best practices

• One statement per principle. Short statements are read; long ones are scrolled past.
• Publish deliberately. Publishing is the moment a statement becomes evidence; a draft changed freely is not.
• Revise by publishing again. Editing a published body moves the version on purpose, so the roster always says who read the text in force.