--- title: "Compliance & Policies" canonical: https://harmony.io/platform/compliance-and-policies --- # Compliance & Policies The single place to manage and enforce every policy across your organization. Policies build on the organizational context you already have and keep learning from every new conversation and change. ## Compliance & Policies The single place to manage and enforce every policy across your organization. Policies build on the organizational context you already have and keep learning from every new conversation and change. ## What is policy management in IT? Policy management is deciding once who gets what and under what conditions - and then having every request honor that decision without a person re-reading the document. Most organizations have the policies written down already. What they lack is a single place where the written rule and the day-to-day behavior are the same thing. In Harmony every policy across IT, HR, finance, security and procurement lives in one governed space with a named owner, an approval chain and full version history. Policies can be built from scratch, uploaded as an existing document, or drafted for you: Harmony reads your knowledge base, documentation and day-to-day requests to surface the policies already operating - including the ones nobody ever formally wrote down. Because the same policies drive the [AI Service Desk Agent](https://harmony.io/platform/ai-service-desk-agent) and every [agent](https://harmony.io/agents) that takes action, eligibility gets answered inside the conversation: the employee asks, the policy decides, the approval chain runs if one applies, and the outcome is logged against the policy version that was in force. ## How Compliance & Policies helps your teams Employee lifecycle policies: define how onboarding, offboarding, and role changes run by role, department, and location, so people are set up and wound down automatically and HR and IT handle only the exceptions Privileged access management: define who qualifies for elevated access and under what conditions, from time limits to peer review to executive sign-off, so access is granted the moment it’s justified Asset purchase and refresh: define a single purchase policy for every scenario, from new hire to upgrade to replacement to refresh, with eligibility that adapts by role, location, and budget, so employees get a complete self-serve experience Vendor and contractor access: define scoped, time-bound access that expires on its own, with eligibility tied to engagement type and duration Travel and expense pre-approval: define spending limits, approval paths, and exceptions up front, so employees get an instant answer and finance steps in when it falls outside policy ## Define policy once, enforce it everywhere ### Define Once Define once, enforce everywhere: set each policy a single time instead of maintaining it in a dozen places ### Less Manual Work Less manual work: policies are detected and drafted automatically from what your organization already does ### Audit Ready Always audit-ready: know exactly which policy applied, to whom, and when ### Early Warnings Problems caught early: get alerted when policies leak, fail, or fall short, before they become a risk ## Powerful capabilities built for enterprise IT - One place to manage every policy: every policy across IT, HR, finance, and security lives in one governed space instead of scattered documents, emails, and team knowledge - Effortless creation and editing: build a policy from scratch, upload an existing document, or adjust a live policy in minutes, with changes taking effect everywhere instantly - Continuous policy learning: reads your knowledge base, documents, and day-to-day requests to understand the policies already operating across your organization - Governance and audit: every policy carries a named owner, approval chain, and full version history ## How Compliance & Policies works **Trigger:** An employee asks for something policy governs: elevated access, a new laptop, a trip, a contractor account. 1. **Learn what already governs you** - Harmony reads your knowledge base, documentation in Confluence, Notion, SharePoint and Google Drive, connected service desks and the requests your team resolves, and drafts the policies it finds operating in practice. 2. **Define the rule once** - Each policy states eligibility by role, department, location and other context, along with limits, approval paths and exceptions. Editing a live policy takes effect everywhere immediately, instead of in a dozen copies. 3. **Decide the request in the flow** - When a request arrives, the applicable policy is evaluated against the requester’s own record, so eligible requests are answered instantly and only genuine exceptions reach a person. 4. **Run the approval chain** - Require all approvers, require any one, or escalate when the first does not respond - with role-based approvers, reminders and timeouts, and time-bound grants that expire on their own for vendors, contractors and elevated access. 5. **Detect drift and prove it later** - Harmony compares documented policy against what is actually happening, flags gaps, leaks and outdated rules, and keeps full version history, so an auditor’s question - which policy applied, to whom, when - has a precise answer. **Outcome:** Policies that are enforced rather than filed, and an audit trail that already exists by the time someone asks for it. ## n8n evidenced 55 SOC 2 controls with an IT team of one n8n runs Harmony with a single IT manager who also owns security and compliance, for a workforce that grew from about 250 to nearly 500 people. The rollout landed mid-cycle in a SOC 2 audit with 55 controls to evidence, took nine weeks from tenant creation to company-wide launch, and SLA attainment rose to 79% from 55% while 26% of 1,260+ employee conversations resolved with no ticket. ## Governed policies vs. policy documents Writing the policy is the easy part. Keeping every request consistent with it is the work. | | Policies as documents | Harmony Compliance & Policies | | --- | --- | --- | | Where the rule lives | A wiki page, a PDF and someone’s memory | One governed policy with an owner, approvers and version history | | Enforcement | Depends on who handles the request | Evaluated against the requester’s record on every request | | Consistency | Copies drift apart across teams and tools | Defined once, applied everywhere it is relevant | | Coverage of reality | Written rules only; informal practice stays invisible | Practice compared against policy, with gaps and drift flagged | | Exceptions | Handled ad hoc, rarely recorded | Routed to the right approver and logged as an exception | | Expiry | Temporary access quietly becomes permanent | Time-bound grants that expire without anyone remembering | | Audit | A search through documents and email threads | Which policy applied, to whom and when, already on record | ## Agents that enforce policy as they run: - [Temporary Admin Access](https://harmony.io/agents/temporary-admin-access) - [Domain Access Security Approval](https://harmony.io/agents/domain-access-security-approval) - [Group Membership Management](https://harmony.io/agents/group-membership-management) - [Software Compliance Report](https://harmony.io/agents/software-compliance-report) - [Unauthorized Applications Detection](https://harmony.io/agents/unauthorized-applications-detection) - [EDR Policy Compliance Discovery](https://harmony.io/agents/edr-policy-compliance-discovery) ## Learn and enforce policies from the systems you already run on - **HRIS: **HiBob, BambooHR, Workday, UKG Pro, SAP SuccessFactors, Sage HR, Rippling, Ceridian Dayforce, Namely - **Documentation: **Confluence, Notion, Microsoft SharePoint, email, Google Drive - **Service desks: **Freshservice, ServiceNow - **Employee platforms: **Workvivo, Simpplr - **Manual upload: **PDFs, internal docs, and any file format ## FAQ ### What does Harmony's Compliance & Policies layer control? Harmony's Compliance & Policies layer is where all of your organizational policies live, giving IT admins a single view of eligibility across every domain: employee lifecycle, privileged access, travel and expense, vendor access, and asset purchase. Every policy carries a named owner, approval chain, and full version history, and builds on the organizational context you already have. ### We already have policies written down. Why do we need this? Most organizations do. The challenge isn’t writing policies -it’s keeping them consistent. Compliance & Policies gives every policy a single source of truth that’s enforced everywhere, preventing drift. It also compares your documented policies with what’s actually happening, flags gaps and outdated rules, and recommends the changes needed to keep them aligned. ### Do we have to build every policy from scratch? No. Policies are detected and drafted automatically from what your organization already does. The system reads your knowledge base, documents, and day-to-day requests to surface the policies already operating, including the ones nobody ever formally wrote down. ### What kinds of policies can we manage? Anything that governs who gets what and under what conditions, across multiple domains, from IT, HR, finance, and procurement to legal and beyond. Common examples include employee lifecycle policies covering onboarding, offboarding, and role changes; privileged access management; travel and expense pre-approval; scoped, time-bound vendor and contractor access; and asset purchase and refresh from new hire to replacement. The same structure works for any policy your organization runs on. ### How does this help my team day to day? Employees get instant answers on what they're eligible for, and when something does need a person, the AI sends it to the right team the first time, adjusting the path as roles, thresholds, and ownership change. Your team is pulled in only for the genuine exceptions: onboarding runs automatically, access expires on its own, and purchase requests route themselves, so IT, HR, and finance spend their time on the cases that actually need a human. ### Will this help us with audits? Yes. Every policy carries a named owner, an approval chain, and a full version history. When an auditor asks which policy applied, to whom, and when, you have a precise answer rather than a search through old documents and email threads. ### Does it work with the systems we already use? Yes. Policies are learned from and enforced across your existing stack: HRIS platforms like Workday, UKG Pro, SAP SuccessFactors, and HiBob; documentation in Confluence, Notion, SharePoint, and Google Drive; Service desks: Freshservice, ServiceNow; and employee platforms like Workvivo and Simpplr. You can also upload PDFs and internal documents directly. ### How is this different from a compliance automation tool like Vanta or Drata? Compliance automation platforms monitor your controls and collect evidence against a framework. Compliance & Policies is where the operational rules live that decide who gets what: eligibility, limits, approval chains and expiry, applied by the agents that actually fulfil requests. They fit together. The policy layer is what makes behavior consistent in the first place, and its version history and decision log are what you hand over as evidence. n8n ran a SOC 2 audit with 55 controls to evidence while rolling Harmony out with a one-person IT team.