PolicyCodex has a small vocabulary. Learning it once makes everything else obvious.

​
Organisation

Your tenant. Every RFC, domain, statement, API key and audit row belongs to exactly one organisation, and row-level security in the database enforces that boundary — there is no query that can reach another organisation’s data. You join an organisation by being invited to it. Creating one makes you its first domain_owner.

​
Architecture domain

A subject area that standards are grouped under, owned by one person. api-design, secure-coding and incident-response are typical. Domains matter more than they look:
  • They decide who can approve — the domain owner is always an eligible approver.
  • They are the filter agents and CI use. A pipeline can check one domain rather than the whole corpus.
  • They section the compiled output — AGENTS.md is organised by domain.

​
RFC

One standards document, in Markdown with YAML frontmatter:
RFCs are numbered per organisation and identified by a slug derived from the title.
The RFC list showing number, title, domain, status and workflow position for each document
Revisions are immutable. Saving a revision writes a new row rather than editing the old one, so the exact text that was approved can always be recovered — which is what makes the audit trail meaningful.

​
Statement

A single testable requirement extracted from an RFC. This is the unit agents and CI actually consume. Slug stability is the load-bearing property. A violation recorded six months ago still resolves to the same statement today, even after the RFC has been rewritten around it. When a statement genuinely disappears it is marked retired, never deleted.

​
Level and severity

RFC 2119 levels map directly onto CI behaviour:

MUST / MUST NOT

Blocking. A finding against an enforced MUST fails the check.

SHOULD / SHOULD NOT

Warning. Reported on the pull request, does not fail the check.
MAY records a permitted option and never produces a finding.

​
Lifecycle status

The line that matters is between approved and enforced:
  • approved — statements are extracted and served to agents, and CI findings are advisory. This is your grace period.
  • enforced — MUST-level findings block merges.
Promotion is a separate, deliberate action so a team can adopt a standard before it starts failing builds. See The lifecycle.

​
Member role

Your role in the organisation, set per member: Roles are assigned in Settings → Members & roles; the per-RFC reviewer and approver assignments use groups.

​
Audit trail

Every lifecycle transition, assignment and extraction appends a row to a hash-chained, append-only log. Each entry’s hash covers the previous entry’s hash, so any tampering breaks the chain and is detectable. See Audit trail.