Compliance

Managed services. Compliance is part of governance and, like it, is available with the Advanced and Ultra plans of Polyant managed services.

The Compliance section, in an agent’s Governance group, records its configuration and governance evidence in three related artefacts: configuration snapshots, a model card, and generated reports.

Reading compliance artefacts requires agent.governance:read. Creating a snapshot, updating a model card, or generating a report requires agent.governance:write.

Configuration snapshots

A configuration snapshot is a versioned record of an agent’s configuration at a point in time. A snapshot captures the current prompts, enabled tools and skills, policy assignments, channel settings without credential values, and other supported agent configuration. It records only the presence of stored secrets, never their values.

The snapshot’s tool list reports the agent’s own persisted rows, deliberately unfiltered by plugin grants: filtering it would falsify an audit record of what was actually configured.

Create a snapshot before an important configuration change or when you need a stable record for review. Snapshots can be listed and retrieved by version for the same agent.

Model cards

Each agent has a model card with two kinds of information:

• Automatic sections are calculated from the current configuration, including system details, enabled capabilities, governance policies, and governance metrics. A condensed view of the card is also the agent’s Overview landing section - the same record, read at a glance.
• Editable sections let operators record purpose and limitations, data protection, oversight and transparency, compliance contacts, and environmental information.

Updating the card merges the submitted sections with the existing record, so operators can maintain the narrative information without recreating the automatically calculated view.

Reports

Generate a compliance report for an explicit reporting period. A report may use a selected configuration snapshot or the agent’s latest snapshot.

The generated report is stored as a structured compliance record. Depending on its type, it combines the model card, configuration snapshot, governance-event audit trail, data-processing record, retention settings, and opt-out configuration. Reports can be listed and retrieved for the agent after generation.

The data-processing record lists the agent’s sub-processors by provider name, never a credential: the chat provider, the embedder, the speech-to-text provider, the LangSmith project when tracing is on, and, for an enabled voice channel, one provider per voice role the call uses (voice, transcription, turn detection, text model and the judges’ classifier).