Agent WranglersControls and evidence Required
Keep every policy short and owned
Give every written policy an owner, a version, an approval date and a review date within 12 months. Track that every person has read the current version.
How to do it
Most audits expect policies on information security, access, incidents, vendors, data retention, acceptable use and the use of AI tools. Keep each one short and in the repository, with front matter for owner and dates. Let each control in the register point to its policy. New staff confirm the policies within 30 days of starting, and everyone again each year. ISO/IEC 27001:2022 control A.5.1 covers policies, and A.6.3 covers awareness training.
Example
---
policy: Access control
owner: maria.lind
version: 4
approved: 2026-03-02
review_by: 2027-03-01
controls: [CTL-MFA-01, CTL-ACCESS-01, CTL-OFFBOARD-01]
---How to check
A script fails when a policy lacks an owner, version or approval date, or its review date has passed. It also fails when an active person has not confirmed every current policy by the due date.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/policies-owned.