Policy packs and industry solutions
Start from a policy pack for your industry, and read readiness from evidence, not from the pack.
Policy packs
A policy pack is a set of deterministic defaults (tool policy, data protection, scanning) that Intertrace merges with your organization's and each agent's settings. Choose one for the organization in Policies, or per agent; an agent's own pack wins over the organization's. When you Protect an agent, a pack is attached by its purpose unless you pick one. Custom policy packs are on Scale and Enterprise. List packs with GET /api/policy-packs.
| Pack | For |
|---|---|
starter_observability | Monitor-only defaults, outbound tool-call scanning on |
saas_tools_strict | Common tool allowlist, outbound scanning, shell danger patterns |
internal_rag | RAG agents: tighter argument size, secret leakage patterns |
regulated_assurance | Block mode, run correlation, strict security profile |
healthcare_hipaa | PHI, patient data and clinical workflows |
financial_services | Accounts, payments and transaction workflows |
legal_confidentiality | Privileged material, legal hold, external disclosure |
public_sector | Citizen records and procurement |
education_ferpa | Student records, grades and minors' data |
customer_support_actions | Constrained refunds, credits and account tools |
devops_engineering | Constrained shell, CI and cloud; blocks secret exfiltration |
retail_pci | Payment-adjacent support and PCI-oriented data controls |
hr_employment | Employee records, compensation and employment decisions |
Industry solutions
Intertrace has eight industry solutions: Financial Services, Healthcare and Life Sciences, Customer Support, Software and Engineering, E-commerce and Retail, Government and Public Sector, Legal and Professional Services, and Insurance. Each names the outcome it protects, the packs it links, and its current gaps. The Industry solutions page shows readiness, takes assurance records and runs evaluation suites.
Readiness is computed per organization from evidence, in a fixed order:
- Preview: defined, but some validation requirements lack qualifying evidence.
- Validated: product and assurance requirements through the validated gate have verified, current, in-scope evidence. Not production validation or independent assurance.
- Production ready: also passes the deployment gate, such as customer-representative deployment or reliability evidence.
- Assured: also has scoped attestation evidence (boundary-specific authorization for government and public sector).
Evidence qualifies only when verified by someone other than the person who submitted it. There is no manual override: expiry, revocation or supersession can lower a claim.