Policy Monitor

/policy-monitor

Sweep mode (no argument or --sweep):

1. Read ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md → outputs folder path, AI policy document, last sweep date.
2. Use the framework below. Scan outputs folder for files since last sweep.
3. For each output: extract approved practices → diff against current policy commitments and use case registry.
4. Classify gaps: REQUIRED (policy misrepresents current practice) vs ADVISABLE (policy silent).
5. For each gap: quote current policy, describe gap, draft suggested language.
6. Flag any use cases in outputs not yet added to the ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md registry.
7. Present results to the human. Only after acknowledgment, update Last policy sweep and gaps_found in ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md.

Direct query mode (with description argument):

1. Read ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md → current policy commitments, use case registry, actual policy document.
2. Parse proposed practice. Diff against policy: use case coverage, automation level, affected parties, disclosure, vendor data use, oversight.
3. Output: covered / missing / conflicting + suggested language for each gap + registry entry if needed + timing recommendation.

Recurring runs: Set up a recurring reminder in your own scheduler to run /ai-governance-legal:policy-monitor weekly. Scheduled execution requires a scheduled-tasks integration, which is not bundled with this plugin.

/ai-governance-legal:policy-monitor
/ai-governance-legal:policy-monitor "We want to use AI to automatically flag expense reports for review"

Purpose

AI policies drift from practice faster than almost any other policy document — the field moves quickly, use cases multiply, and each approved AIA or triage result represents a new commitment the policy may not have caught up with. An AIA approves a new AI use case with a human-oversight condition. A vendor AI agreement permits data processing the policy doesn't mention. A triage result marks a new category of deployment as conditional with a disclosure requirement. The policy sits there unchanged.

This skill catches the drift — either by crawling the outputs folder weekly, or by answering the direct question: "we're about to start doing X, what does that mean for our AI policy?"

The output is always the same: here's the gap, here's the suggested language.

Load current state

Read ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md:

• ## AI policy commitments — commitments extracted from the published policy
• ## Use case registry — approved, conditional, and never use cases
• ## Outputs — outputs folder path, AI policy document location, last sweep date

If ## Outputs contains [PLACEHOLDER]:

"Outputs aren't configured yet. I can still run a direct-query check — describe what you're planning to do and I'll diff it against your current AI policy. To enable the crawl sweep, run /ai-governance-legal:cold-start-interview and provide the outputs folder path."

Read the actual AI or acceptable use policy document from the path in ## Outputs → AI policy document. The commitments in ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md are a summary; the actual document is authoritative for suggesting edits.

Mode detection

Sweep mode: No argument, --sweep, or triggered by schedule. → Scan the outputs folder. Diff all outputs since last sweep against current policy.

Direct query mode: User provides a description of a proposed new AI practice. → Diff that practice against current policy and use case registry. Suggest updates.

Mode 1: Sweep

Determine scope

Read ## Outputs → Last policy sweep date. Scan for output files in the outputs folder dated after that date. If no date is recorded, scan all files and note: "First sweep — scanning all outputs."

If the outputs folder is empty or has no new files since the last sweep:

"No new outputs since [last sweep date]. AI policy appears current with recent practice. Next scheduled sweep: [date]."

Do not update `Last policy sweep` or `gaps_found` automatically. After the sweep results are presented, wait for the human to acknowledge them ("sweep acknowledged," "results reviewed," or equivalent). Only then update ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md:

• Last policy sweep: [date of acknowledgment]
• gaps_found: [N] (number of REQUIRED + ADVISABLE gaps found in that sweep)

Updating the stamp before acknowledgment would let an unreviewed sweep silently roll forward and suppress the next sweep's attention to the same gaps.

What to read in each output type

AIAs (AI Impact Assessments):

• Extract: use case approved, AI system description, deployment mode (assistive / augmentative / automated), conditions imposed, affected parties, vendor used, any disclosure requirements to affected individuals
• Flag: use cases not in the registry, use cases approved with conditions not reflected in policy, vendor added that policy doesn't cover, automated decision deployed where policy implies human oversight

Triage results (CONDITIONAL / APPROVED outcomes):

• Extract: use case classified, tier assigned, conditions imposed
• Flag: new use case categories not in registry, conditions that imply policy commitments (e.g., "must disclose to affected parties" — does the policy say you do this?), newly approved practices that expand policy scope

Vendor AI reviews (signed / approved):

• Extract: vendor added, data use terms agreed to, any AI-specific provisions accepted that differ from standard positions in ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md
• Flag: vendors added whose data use terms the policy should reference (e.g., "we use third-party AI services and ensure they do not train on our data"), approved deviations from standard positions that the policy implies you hold

Use case registry updates:

• If new entries were added to the registry since the last sweep (directly, not through an AIA), check whether the policy reflects those approved categories.

Gap identification

For each flagged item, assess:

REQUIRED update — the policy makes a commitment that an output contradicts, or an approved use case has no policy coverage and affects external parties. Not updating creates a material misrepresentation.

Example: AI policy says "we do not use AI in employment decisions." An AIA approved an AI-assisted hiring screening tool with human review required. Policy needs updating — even with human review, AI is now involved in employment decisions. "We do not use AI" is no longer accurate.

ADVISABLE update — policy is silent but not in conflict. The practice is defensible without updating, but cleaner with it. Important when the practice affects external parties or creates a reasonable expectation.

Example: Policy says "we use AI to improve our products and services." An AIA approved an AI feature for customer support drafts. Policy technically covers it but is vague. Advisable to be more specific so customers know what they're interacting with.

Sweep output format

[WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see `## Who's using this`]

*This sweep is derived from AIAs, triage results, and vendor AI reviews that carry the plugin's privilege/confidentiality marking. The sweep inherits that status. Distribute deliberately — forwarding gap findings outside the privilege circle can waive privilege on the underlying assessments.*

# AI Policy Monitor — Sweep Report

**Date:** [date]
**Outputs scanned:** [N files] | **New since last sweep:** [N files]
**Gaps found:** [N] REQUIRED | [N] ADVISABLE

---