# GRD-017: Provide sensible policy defaults and no-code authoring


- Area: Runtime Guardrails

- Verification: Walkthrough
- OWASP adoption tier: AT0–AT4, AT6
- Formerly: POL-006
- URL: /r/GRD-017

**Acceptance criteria:** Editable baseline policies and recommended settings without regex or specialist rule writing.

**Why it matters:** Policy work should not require regex skills.

**How to verify:** Show the default policy set and author a new policy without writing patterns.

**OWASP adoption context:** Policy-authoring usability and defaults are governance-platform concerns across adoption tiers, rather than properties of a particular AI deployment pattern.

**Mappings:**
- NIST CSF 2.0: GV.PO-01; NIST AI RMF: GOVERN 1.4; ISO 42001: A.2.2; SOC 2: CC5.3; ISO 27001: A.5.1, A.5.10 — Editable baseline policies and recommended settings help turn AI-risk decisions into documented security and acceptable-use rules. Easy authoring is an input to establishing and deploying policy; template availability does not establish approval, communication, review or enforcement.