Why it exists
Most engineering standards live in a wiki that nobody reads and no tool can act on. The moment you point an AI coding agent at your codebase, that gap becomes expensive: the agent has no idea what your organisation requires, and you have no way to prove what it was told. PolicyCodex closes both halves of that gap.Governed
Every standard has an owner, a lifecycle, an approver, and an append-only,
hash-chained audit trail. You can prove who approved the rule an agent followed.
Agent-neutral
The same corpus compiles to
AGENTS.md and is served over MCP, so Claude Code,
Cursor, Copilot and your own tooling all read one source of truth.Enforced
Approved standards produce advisory findings. Enforced standards block merges.
Promotion between the two is a deliberate, audited act.
How a standard travels
1
Author
Write the RFC in Markdown with YAML frontmatter. The editor lints RFC 2119 keywords
as you type.
2
Review and approve
Propose it, have a reviewer group sign off, then have the approver group or domain
owner approve. Each transition writes an audit row.
3
Extract
On approval, PolicyCodex extracts individual statements — each with a stable slug, an
RFC 2119 level, and an SDLC stage.
4
Enforce
Promote to
enforced. From this point a MUST-level finding fails the CI check
instead of merely warning.5
Consume
Agents query the MCP server; CI runs the GitHub Action; anyone can export
AGENTS.md or the full audit log.Start here
Core concepts
Domains, RFCs, statements, levels and the lifecycle — the vocabulary the rest of
these docs assumes.
Write your first RFC
From an empty editor to a proposed standard.
Connect an agent
Point Claude Code or any MCP client at your governed corpus.
Enforce in CI
Add the GitHub Action and start blocking non-compliant pull requests.