---
title: Policies & acknowledgments
description: Publish a policy as an immutable version, roll it out to a frozen audience, and keep signature evidence pinned to a SHA-256 fingerprint
order: 3
---

A **policy** is a document people must read and confirm, such as a handbook or a code of
conduct. Three objects with different lifetimes: the **policy** ("Employee handbook"), a
**version** (the exact bytes people were asked about, pinned with a SHA-256 fingerprint), and a
**rollout** (one version sent to one audience with its own due date, called a **campaign** in the
UI).

Policies live under **People → Company documents**; publishing, campaigns and the **Campaigns**
tab are admin-only.

## Publishing a version

**New version** on a Policy publishes the next version from a new upload. Versions are never
edited: publishing leaves the previous version and its signatures untouched, and each version's
fingerprint is copied onto every signature against it.

**In force since** backdates a version - it records when the text took effect, never delays it. A
future date is refused with a 400; blank records no effective date.

## Rolling it out

Open a policy document, pick a version, then choose **Start campaign** and an audience: **All
active employees**, **One team**, or **One person**. The audience is **frozen** there - a later
joiner is not added, a leaver does not drop out. Over 2,000 people the campaign is refused with a
409; roll a large workspace out team by team.

Asks land in **Inbox → Needs action** under **Documents to sign**. A due date, which cannot be
in the past, enrols the ask in the nightly overdue digest - reminders at one and three days
overdue, then weekly to day 30. An undated ask sends none.

Two campaigns for one version converge on **one** obligation - the person signs **once** and
both count it. Progress reads three counts: signed, outstanding, no longer required.
**View roster** lists the audience with each person's state; **Export signatures** downloads it
as CSV.

**Edit details** carries **Ask new joiners to sign the current version**. It reaches forward
only, and its asks carry no due date, so they never reach the digest.

## Signing

The person chooses **Review & sign** and types their full name. The evidence row records that
name, the version's fingerprint, the time, the channel (`ui`, `mcp` or `api`), the caller's IP
address and user agent. A name over 120 characters is refused, never truncated. Only the
obligation's own employee may sign it - anyone else gets a 403, a second signature a 409. This is
acknowledgment capture, not a qualified electronic signature.

## Closing and revoking

Closing a campaign is terminal. Signatures stand, and its still-open asks are cancelled unless
another open campaign, auto-enrolment or a process run also created them. Closing answers 409
while a process run waits on one of those acknowledgments; cancel the run first.

**Revoke signature** on the roster deletes the acknowledgment row, reopens the obligation, and
writes the full evidence snapshot and the stated reason to the immutable audit log. It works on
closed campaigns too.

A process **policy acknowledgment** action waits until the subject signs, and completes at once
when they already signed the active version; a process naming a policy with no published
version is refused at publish ([Processes](/docs/processes/overview/)).

## Worked example

Marta publishes version 2 of Northlake's handbook and starts a campaign for **All active
employees**, due in two weeks; the 15 people active that day freeze into the roster. Tomasz signs
from **Inbox → Needs action**, and his evidence row carries version 2's fingerprint. Aleksandra
joins the week after, so only the new-joiner switch asks her.

> [!AGENT]
> Which policy rollouts are still open, and who hasn't signed yet?

## Related

- [Company documents](/docs/documents/overview/)
- [Processes](/docs/processes/overview/)
- [Data protection and GDPR](/docs/admin/privacy/)