Policy & Guardrails
Configure and test runtime rules. Inspect which rule applied, the text that matched, and the action recorded.
View the capabilityThinkStack for audit evidence
Produce the evidence for an assessment as the work happens.
When an auditor or regulator asks what happened, teams rebuild the answer from logs, email, and memory. ThinkStack records each agent action with the policy that applied and the sources used, so the people who own a control can inspect the record and assemble the evidence for their own review.
The work to improve
Stop rebuilding the story each time someone asks.
An assessment asks what happened, who approved it, which rule applied, and where the information came from. When those records sit in different systems, answering takes a team weeks and reflects one moment instead of the months in between. Recording the evidence while the work runs turns the next request into assembling records that already exist.
01 · Inputs your team can access
Control requirementsPolicies, standards, and the evidence each control needs
Execution recordsTool calls, source lookups, and generated responses
Policy historyVersions, changes, and approvals
Review recordsFindings, exceptions, and sign-offs
ThinkStack
Configured agents, tools, and workflow steps
Policy & GuardrailsConfigure and test runtime rules. Inspect which rule applied, the text that matched, and the action recorded.Observability & TracingInspect tool calls, source retrievals, generated responses, errors, and usage costs for each run.Evaluation HarnessScore representative cases against defined rubrics and compare automated scores with human review.Knowledge Base ManagementCurate the reference material available to agents and manage its classification, access, and lifecycle.Enterprise SearchRetrieve relevant passages from connected information within the configured permissions.Document Writing AgentsReview proposed edits as tracked changes, with supporting source passages, author details, and revision history.
Defined access · Configured checks · Accountable reviewers
02 · Outputs for review
Control test resultsCases run and behavior observedActivity recordWhat an agent did, step by stepEvidence packageSource records for the control owner's review
Where to start
Three places to start
Pick one control or audit request and agree on the evidence it needs. These workflows show the pattern; retention, access, and export depend on your configuration and on your compliance team's requirements.
01Test a control before it goes liveSee how a proposed rule behaves before you publish it.
- Start with
- The control requirement, cases the policy should allow, and cases it should block.
- Agent preparation
- Run the cases against the draft guardrail, show which rules fired and the text that matched, and score the results against your rubric.
- What your team receives
- Test results for the control owner, with the policy version tested.
- Human review and approval
- The control owner reviews false positives and missed cases and decides whether to publish.
- What to measure
- Time to test a policy change, false positives, and missed violations.
02Reconstruct what an agent didFollow a questioned response back through the steps that produced it.
- Start with
- A questioned response and the run that produced it.
- Agent preparation
- Retrieve the tool calls, source lookups, guardrail decisions, and errors for the run, and link each finding to the execution record.
- What your team receives
- An activity record an investigator can follow step by step.
- Human review and approval
- The investigator decides whether a control failed and what corrective action to take.
- What to measure
- Time to assemble the record, completeness of the evidence, and time to verify the fix.
03Prepare an evidence packageGather the records an assessor asked for, with sources attached.
- Start with
- An audit request, the control it relates to, and the approved record sources.
- Agent preparation
- Search the approved sources within the requester's permissions, draft the narrative with source references, and list what is missing.
- What your team receives
- A draft evidence package with the supporting records attached or listed.
- Human review and approval
- The control owner checks completeness and accuracy, adds missing items, and approves what goes to the assessor.
- What to measure
- Hours to assemble the package, items found missing late, and rework after the assessor's questions.
Review example
Inspect one guardrail decision
A reviewer can see the policy version, the matched text, and the action taken, then open the related trace.
- Control
- Personal identifiers must not leave the intake workflow
- Policy version
- Version 7, approved by the control owner
- Event
- A request contained a personal identifier
- Recorded action
- The identifier was replaced with a placeholder
- Linked evidence
- The execution trace for the same run
Your compliance team defines what counts as evidence, how long it is kept, and who may see it. ThinkStack records and organizes; people judge whether a control is effective.
Pilot measurement
Measure the effort to answer a request.
Time two recent audit requests as you handle them today. Run comparable requests during the pilot, and count review and correction time as well as assembly time.
- Time to assemble
- Hours from request to a package the control owner will review.
- Completeness
- Items found missing after the package was reviewed.
- Rework
- Follow-up questions from the assessor or the reviewer.
- Control testing
- False positives and missed cases found before release.
Platform capabilities
The modules behind these workflows
Review the relevant capabilities with your technical team and confirm the configuration for the intended use.
Evaluation Harness
Score representative cases against defined rubrics and compare automated scores with human review.
View the capabilityObservability & Tracing
Inspect tool calls, source retrievals, generated responses, errors, and usage costs for each run.
View the capabilityEnterprise Search
Retrieve relevant passages from connected information within the configured permissions.
View the capabilityDocument Writing Agents
Review proposed edits as tracked changes, with supporting source passages, author details, and revision history.
View the capabilityKnowledge Base Management
Curate the reference material available to agents and manage its classification, access, and lifecycle.
View the capabilityRelated
Explore related pages
See how this outcome connects to the work of other teams and industries.
Common questions
Before you plan the workflow
Does this make us compliant?
No. ThinkStack provides policy enforcement records, traces, and source references that can support your assessment. Your compliance, legal, and quality teams define the requirements, and assessors decide whether they are met. This does not establish certification or regulatory approval.
What does the record contain?
For each run: the tool calls, source lookups, generated responses, errors, and usage, plus which guardrail rules fired, the text that matched, and the action taken. What is retained, masked, or exported follows your configuration.
Who can see sensitive information in the records?
Access follows the permissions you configure. Agree who may inspect traces, what is masked, and how long records are kept before a workflow goes into production.
What is still in development?
Some monitoring features, such as scheduled theme detection and per-agent drift alerts, are still in development. We will tell you which ones a workflow depends on before you commit.