AI Policy Statements

AI policy statements let you publish your organization's AI policy in MITRITY, and record who has read it. Each statement is one of your organization's own commitments, written in your own words.

You write one statement per principle: human oversight, privacy, transparency, accountability and the others in the risk catalog. You can also write a general statement.

Statements are versioned. The owner publishes them, and the people who read them attest to them. A published statement is evidence that a policy exists. The attestation roster is evidence that people saw it.

Lifecycle

Publishing, retiring and attesting are written to the audit trail as compliance.policy.published, compliance.policy.retired and compliance.policy.attested, with the acting user.

Attestation

Any signed-in user can attest to a published statement. To attest is to say you have read it.

An attestation is pinned to the version the user read. When a published statement's body changes, its version moves on, and the roster shows the earlier attestations as attestations to an earlier version. A statement that changed after someone attested never silently inherits their name.

Attesting twice to the same version records nothing new.

A person who is later removed from your account stays on the roster by the email recorded at the time. An attestation is a record of something that happened.

Mark a statement attestation required to ask every user to read it. The frameworks page counts published statements as full evidence when no statement requires attestation, or when someone has attested to the version in force. While statements require attestation and nobody has attested to the version in force, they count as partial evidence that a policy exists.

From the API

List statements (any role; optional ?status=draft|published|retired):

curl https://api.mitrity.com/api/v1/compliance/policy-statements \
  -H "Authorization: Bearer mk_your-api-key"

Create a draft (manager or owner). The slug is lowercase letters, digits and hyphens, and cannot change later. principle names a risk class from the catalog; omit it for a general statement:

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements \
  -H "Authorization: Bearer mk_your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "slug": "human-oversight",
    "title": "Human oversight of autonomous agents",
    "principle": "human_oversight",
    "body_markdown": "## Human oversight\n\nEvery agent that can act irreversibly runs behind a hold rule with a named approver…",
    "requires_attestation": true
  }'

{
  "id": "1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a",
  "slug": "human-oversight",
  "title": "Human oversight of autonomous agents",
  "principle": "human_oversight",
  "version": 1,
  "status": "draft",
  "requires_attestation": true,
  "published_at": null,
  "created_at": "2026-09-22T08:15:00Z"
}

Edit a statement (manager or owner for a draft; owner for a published one):

curl -X PUT https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a \
  -H "Authorization: Bearer mk_your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"title": "Human oversight of autonomous agents (revised)"}'

Publish (owner):

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/publish \
  -H "Authorization: Bearer mk_your-api-key"

Attest to the version in force (any role):

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/attest \
  -H "Authorization: Bearer mk_your-api-key"

The roster:

curl https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/attestations \
  -H "Authorization: Bearer mk_your-api-key"

{
  "statement_id": "1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a",
  "current_version": 2,
  "current_count": 1,
  "attestations": [
    { "statement_version": 2, "user_email": "ana@example.com", "user_name": "Ana Platform", "attested_at": "2026-09-22T09:00:00Z", "current": true },
    { "statement_version": 1, "user_email": "lee@example.com", "user_name": null, "user_id": null, "attested_at": "2026-09-20T16:40:00Z", "current": false }
  ]
}

Retire (owner):

curl -X POST https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a/retire \
  -H "Authorization: Bearer mk_your-api-key"

Delete a draft (owner; a published statement is retired instead):

curl -X DELETE https://api.mitrity.com/api/v1/compliance/policy-statements/1d2c3b4a-5f6e-4d7c-8b9a-0f1e2d3c4b5a \
  -H "Authorization: Bearer mk_your-api-key"

Best practices

• Write one statement per principle. People read short statements, and scroll past long ones.
• Publish deliberately. Publishing is the moment a statement becomes evidence. A draft, which changes freely, is not evidence.
• Revise by publishing again. Editing a published body moves the version on purpose, so the roster always says who read the text in force.