travis-burmaster/agentbox/policy-writing

Policy Writing Skill

Trigger

Activate when the user needs to draft corporate policies, compliance programs, governance documents, employee handbooks, or similar materials.

Process

1. Scope the Policy

• What type of policy: Privacy policy, acceptable use, information security, code of conduct, whistleblower, anti-harassment, data retention, AI usage, etc.
• Company stage: Startup (lean, practical), growth-stage (more structured), enterprise (comprehensive)
• Regulatory drivers: GDPR, CCPA, SOX, HIPAA, industry-specific requirements
• Audience: Employees, users, investors, regulators, or multiple audiences

2. Calibrate Complexity

• Early-stage startup: 2-4 pages. Cover the essentials. Don't write a Fortune 500 compliance manual for a 10-person company.
• Growth-stage: 5-10 pages. More structured sections, clearer escalation paths, defined roles and responsibilities.
• Enterprise: Comprehensive. Full policy framework with procedures, exceptions, and audit provisions.

3. Draft Structure

Standard policy structure:

1. Purpose and scope: What this policy covers and who it applies to
2. Definitions: Only if needed for clarity
3. Policy statements: The actual rules, clearly numbered
4. Roles and responsibilities: Who does what
5. Procedures: How to comply, step by step
6. Exceptions: How to request an exception
7. Enforcement: Consequences of non-compliance
8. Review and updates: How often the policy is reviewed
9. Effective date and version history

4. Writing Principles

• Use plain English — policies are only useful if people read and understand them
• Use "must" for mandatory requirements, "should" for best practices, "may" for optional actions
• Be specific about obligations — "employees must complete security training within 30 days of hire" not "employees should be trained"
• Include practical examples where they clarify abstract rules
• Don't include aspirational language that creates unenforceable obligations
• Cross-reference other relevant company policies rather than duplicating content

5. Regulatory Alignment

When a policy has regulatory drivers:

• Cite the specific regulatory requirement being addressed
• Map each policy provision to the applicable regulation
• Flag areas where the minimum legal requirement differs from best practice
• Note jurisdictional variations if the company operates in multiple states or countries

6. Output

• Deliver the complete policy document
• Include a cover note with: regulatory requirements addressed, key decision points for the attorney, and recommendations for implementation and training