Download and adapt the policy
The editable Markdown template includes placeholders for the policy owner, approved tools, data classes, release workflow and incident contact. It is a starting point for your organization’s review, not a certification or a statement that SpringRoll enforces every policy clause.
Match each rule to a control and a person
Use the table when reviewing your policy. SpringRoll records and controls the application handoff. Your organization chooses which AI vendors and data classes are allowed, maintains app permissions and owns the incident process.
Scroll sideways to see all columns. With the table focused, use the arrow keys.
| Policy rule | SpringRoll control | Organization responsibility |
|---|---|---|
| Name an accountable owner and support contact | App ownership and release records | Keep ownership current when people change roles. |
| Use approved AI tools and permitted data | Company Blueprint publishes guidance to connected agents | Approve vendors and data classes; guidance is not device-wide enforcement. |
| Keep source-system credentials out of prompts and app bundles | Connect holds source credentials server-side | Review source and built assets; rotate secrets exposed elsewhere. |
| Request only necessary company data | Environment-specific field/query or native endpoint grants | Choose scope, source-account permissions and expiry; verify denied access. |
| Review a release before production when required | Staged workflow and recorded human decisions | Configure Staged; Direct to Production is the default. |
| Limit who can use the app | App Portal audience checks | Protect the direct app URL and server-side business operations. |
| Keep evidence and a maintenance handoff | Immutable release history and audit events | Keep source, acceptance results, support ownership and incident procedures. |
Apply the template to one purchase request app
Start with the Purchase Desk example and fictional records. Name the owner, select the intended Finance audience and write the acceptance task. Decide whether this app requires Staged review before the first deployment.
Test an allowed colleague and someone outside the audience, then test the provider URL independently. Keep the release and the results with the handoff. If real purchasing data is needed later, request its grant separately; the prototype’s success does not authorize that connection.
Make exceptions and incidents actionable
The template asks for an exception owner, a reason, a scope and a review date. An agent should surface a blocked approval to the responsible person. It should not invent an approver or treat an earlier approval as authorization for a broader change.
For an exposed credential or unintended audience, contact the named incident owner and review the affected grant, deployment and app sessions. Revocation stops future authorized access; it does not erase data already copied by an application.