Policy Domain

The Policy domain establishes rules, guidelines, and standards governing operations and decision-making. Policies are structured as dynamic elements within business architecture, directly influencing execution across capabilities, value streams, and information domains.

Schema: policy.schema.json
Specification: JSON Schema Draft-07

Overview

What is a Policy?

A policy represents a formal statement of principles, rules, or guidelines that govern behavior and decision-making within an organization. Policies provide the framework for:

Operational governance — Rules for how work is performed
Compliance management — Adherence to regulations and standards
Risk mitigation — Controls to reduce organizational risk
Decision frameworks — Guidelines for consistent decision-making

The domain emphasizes operationalization of policies by linking them to specific processes, capabilities, and workflows to ensure active enforcement and alignment.

Purpose and Value

The Policy domain enables architects and planners to:

Document governance frameworks with consistent structure
Link policies to operations through capability and process connections
Track compliance via metrics and monitoring
Manage policy lifecycle including reviews and updates
Support audits through traceability and evidence

For Data Engineers

The Policy domain maps directly to data governance concepts:

Policy → Data Governance Policy /Data Quality Rule
Requirements → Data quality checks /Validation rules
Compliance Metrics → Data quality scores /Compliance dashboards
Review Frequency → Policy refresh cycles
Related Policies → Policy dependencies and hierarchies

Core Components

The Policy domain includes essential elements:

Policy Statement: Core rules and guidelines being established
Requirements: Specific conditions or criteria to be met
Compliance Metrics: Measures to ensure adherence
Approval Chain: Individuals or groups who approve the policy
Related Policies: Connected or dependent policies

Domain Attributes

Core Attributes

Attribute	Type	Description	Required
`policyID`	String	Unique identifier for the Policy, e.g. `POL-001`	✓
`title`	String	Name or title of the Policy
`description`	String	Detailed explanation of what the Policy entails
`purpose`	String	Intended purpose or function within the Organization
`scope`	String	Range or extent to which the Policy applies
`enforcedBy`	String	Party responsible for enforcing the Policy
`owner`	String	Individual or team responsible for the Policy
`orgUnitTitle`	String	Organization unit(s) to which the Policy is linked
`orgUnitID`	String	ID of the organization unit named in `orgUnitTitle`
`requirements`	String	Specific conditions or criteria to be met under the Policy
`complianceMetrics`	String	Measures to ensure adherence to policies
`reviewFrequency`	String	How often the Policy is reviewed and updated
`approvals`	String	Individuals or groups that must approve the Policy
`relatedPolicies`	String	Policies that are related or linked
`relatedPolicyIDs`	Array[String]	IDs of related Policies
`complianceAndStandards`	String	Regulatory requirements and standards the Policy must adhere to
`risks`	String	Potential risks associated with the Policy and its implementation
`improvementOpportunities`	String	Areas for enhancement
`strategicAlignment`	String	Alignment with strategic goals

Free-text Attributes

Apart from the identifiers, every Policy attribute is free text. reviewFrequency is narrative so that it can state conditions, for example "Annually, and after any change to FRA track safety regulations". complianceAndStandards names the specific regulations and standards, for example "49 CFR Part 213 (FRA Track Safety Standards)" or "GDPR, CCPA, ISO 27001".

Links from a Policy to the capabilities, processes and value streams it governs are recorded as cross-domain relationships rather than as Policy attributes.

Domain Relationships

The Policy domain integrates with other metamodel domains:

Target Domain	Relationship Type	Description
Organization	Ownership	Organization units own and enforce policies
Capabilities	Governance	Policies govern capability execution
Value Stream	Compliance	Value streams comply with relevant policies
Information	Protection	Policies protect information assets
Services	Standards	Policies set service delivery standards
Products	Quality	Policies define product quality requirements
Performance	Measurement	Policies measured through compliance metrics
Initiatives	Alignment	Initiatives comply with policy constraints
Stakeholder	Accountability	Stakeholders accountable for policy adherence
Technology	Control	Policies control technology usage

Examples

Example 1: Track Safety Standards Policy

{
  "policyID": "POL-001",
  "title": "Track Safety Standards Compliance Policy",
  "description": "Comprehensive framework for ensuring compliance with FRA track safety standards across all rail classifications and operational territories",
  "purpose": "Maintain consistent track safety standards across all rail classifications to ensure safe operations",
  "scope": "All track infrastructure across the national rail network",
  "enforcedBy": "Office of Railroad Safety, through the automated inspection tracking system, supervisor audits and third-party verification",
  "owner": "Director of Track Safety Standards",
  "orgUnitTitle": "Track and Rail Infrastructure Division",
  "orgUnitID": "OU-001",
  "requirements": "Daily track inspections for Class 4-5 track, bi-weekly for Class 1-3. All defects documented within 4 hours. Critical defects addressed within 24 hours. Weather-related delays documented and approved by the Regional Director. Annual certification for all track inspectors.",
  "complianceMetrics": "Inspection completion rate: 99.4%, Documentation accuracy: 98.7%, Defect resolution time: 95% within SLA",
  "reviewFrequency": "Annually, and after any change to FRA track safety regulations",
  "approvals": "FRA Administrator, Chief Safety Officer, Regional Directors",
  "relatedPolicies": "Track Inspector Qualification Policy, Track Maintenance Standards, Emergency Response Procedures",
  "relatedPolicyIDs": ["POL-002", "POL-003", "POL-004"],
  "complianceAndStandards": "49 CFR Part 213 (FRA Track Safety Standards), internal safety standards",
  "risks": "Documentation gaps, inspection delays, resource constraints",
  "improvementOpportunities": "Implement digital inspection records, streamline approval process, automate compliance reporting",
  "strategicAlignment": "Supports zero-accident goal through systematic inspection procedures"
}

Example 2: Data Governance Policy

{
  "policyID": "POL-010",
  "title": "Enterprise Data Governance Policy",
  "description": "Establishes standards and procedures for data management, quality, security, and usage across the organization",
  "purpose": "Ensure data is managed as a strategic asset with appropriate quality, security, and compliance controls",
  "scope": "All enterprise data assets and data processing activities",
  "enforcedBy": "Data Governance Council, through automated data quality monitoring, access audits and governance dashboard reviews",
  "owner": "Chief Data Officer",
  "orgUnitTitle": "Data and Analytics Division",
  "orgUnitID": "OU-010",
  "requirements": "All data assets must have assigned owners. Data quality scores must exceed 95%. Sensitive data must be classified within 30 days of creation. Data lineage must be documented for all analytical assets. Data stewards must hold steward certification.",
  "complianceMetrics": "Data ownership coverage: 98%, Average data quality score: 96.2%, Classification compliance: 99.1%",
  "reviewFrequency": "Quarterly",
  "approvals": "Chief Data Officer, Data Governance Council, Legal Review",
  "relatedPolicies": "Data Classification Policy, Data Retention Policy, Privacy Policy, Access Control Policy",
  "relatedPolicyIDs": ["POL-011", "POL-012", "POL-013", "POL-014"],
  "complianceAndStandards": "GDPR, CCPA, DAMA-DMBOK, internal data standards",
  "risks": "Data quality degradation, unauthorized access, compliance violations",
  "improvementOpportunities": "Implement automated data cataloging, enhance self-service governance tools",
  "strategicAlignment": "Enables data-driven decision making and supports digital transformation initiatives"
}

Example 3: Information Security Policy

{
  "policyID": "POL-020",
  "title": "Information Security Policy",
  "description": "Defines security requirements for protecting organizational information assets from unauthorized access, disclosure, modification, or destruction",
  "purpose": "Protect information assets and maintain confidentiality, integrity, and availability",
  "scope": "All information systems, data, and personnel",
  "enforcedBy": "Information Security Division, through automated security monitoring, penetration testing and compliance audits",
  "owner": "Chief Information Security Officer",
  "orgUnitTitle": "Information Security Division",
  "orgUnitID": "OU-020",
  "requirements": "Multi-factor authentication required for all systems. Encryption required for data at rest and in transit. Security assessments quarterly. Incident response within 1 hour.",
  "complianceMetrics": "MFA adoption: 99.8%, Encryption coverage: 100%, Security assessment completion: 100%",
  "reviewFrequency": "Semi-annually",
  "approvals": "CISO, CTO, Legal Counsel, Audit Committee",
  "relatedPolicies": "Access Control Policy, Incident Response Policy, Acceptable Use Policy",
  "relatedPolicyIDs": ["POL-021", "POL-022", "POL-023"],
  "complianceAndStandards": "ISO 27001, SOC 2, GDPR",
  "risks": "Data breaches, unauthorized access, system compromise",
  "strategicAlignment": "Protects organizational assets and maintains stakeholder trust"
}

Implementation Guidelines

Policy Management Best Practices

Clear ownership — Assign accountable owners for each policy
Regular review — Establish and follow review schedules
Operational linkage — Connect policies to processes and capabilities
Measurable compliance — Define quantifiable compliance metrics
Exception management — Document and track approved exceptions

Policy Lifecycle

Policy Hierarchy

Policies should be organized in a logical hierarchy:

OpenMetadata Integration

For Data Platform Teams

When integrating with OpenMetadata, map Policy entities as follows:

Triodian Element	OpenMetadata Entity	Notes
Data Policy	Glossary + Tags	Policy definitions as terms
Requirements	Data Quality Tests	Policy rules as tests
Compliance Metrics	Test Results	Compliance tracking
Compliance and Standards	Classification	Regulatory categorization
Related Policies	Related Terms	Policy relationships

# Example: Create policy-based data quality tests
def create_policy_tests(policy):
    """
    Map Triodian Policy to OpenMetadata data quality tests
    """
    tests = []
    
    # Parse requirements into testable rules
    requirements = policy.get("requirements", "").split(".")
    
    for i, req in enumerate(requirements):
        if req.strip():
            test = {
                "name": f"{policy['title'].lower().replace(' ', '_')}_rule_{i+1}",
                "displayName": f"{policy['title']} - Rule {i+1}",
                "description": req.strip(),
                "testDefinition": {
                    "name": "policyComplianceTest",
                    "description": f"Tests compliance with: {req.strip()}"
                },
                "testSuite": f"{policy['policyID']}Compliance",
                "owner": {
                    "name": policy["owner"],
                    "type": "user"
                },
                "tags": [
                    {"tagFQN": f"Policy.{policy['policyID']}"}
                ]
            }
            tests.append(test)
    
    return tests

# Example: Create policy glossary term
def create_policy_term(policy):
    """
    Create OpenMetadata glossary term for policy
    """
    return {
        "name": policy["title"].lower().replace(" ", "_"),
        "displayName": policy["title"],
        "description": policy["description"],
        "glossary": "enterprise_policies",
        "tags": [
            {"tagFQN": f"Policy.{policy['policyID']}"}
        ],
        "owner": {"name": policy["owner"], "type": "user"},
        "relatedTerms": [
            p.lower().replace(" ", "_") 
            for p in policy.get("relatedPolicies", "").split(",")
            if p.strip()
        ],
        "synonyms": [],
        "references": [
            {"name": std.strip(), "endpoint": ""}
            for std in policy.get("complianceAndStandards", "").split(",")
            if std.strip()
        ]
    }

Schema Reference

Repository: Triodian/Triodian_Metamodel
Schema: policy.schema.json
Specification: JSON Schema Draft-07
License: Apache License 2.0

Previous: Initiatives Domain | Next: Value Stream Domain

Overview​

What is a Policy?​

Purpose and Value​

Core Components​

Domain Attributes​

Core Attributes​

Free-text Attributes​

Domain Relationships​

Examples​

Example 1: Track Safety Standards Policy​

Example 2: Data Governance Policy​

Example 3: Information Security Policy​

Implementation Guidelines​

Policy Management Best Practices​

Policy Lifecycle​

Policy Hierarchy​

OpenMetadata Integration​

Schema Reference​