policy

ArchiMate 3.2 Equivalent: Principle / Constraint (Motivation & Governance Aspect)

Represents an enterprise governance policy, regulatory framework mandate, or compliance constraint.

Visual Styling

To apply custom icons, borders, or CSS styles to policies, use a Style Rule (e.g. style policy where enforcement == "Mandatory" { icon "shield-lock" }).

---

Syntax

policy <id> "<Display Name>" {
    description "<text>"
    owner "<team>"
    tags ["tag1", "tag2"]
    classification "<text>"
    status "Active" | "Draft" | "Deprecated"
    priority "Critical" | "High" | "Medium" | "Low"
    policy_type "Security" | "Privacy" | "Compliance" | "Operational" | "Data Governance" | "Access Control" | "AI Governance" | "Risk Governance" | "IT Governance" | "Cloud Security" | "Vendor Risk Management"
    enforcement "Mandatory" | "Advisory" | "Automated" | "Recommended" | "Optional"

    relationships { ... }
}

---

Properties

Property	Type	Allowed Values	Description
description	string	Free text	Policy charter, scope, and non-compliance consequences
owner	string	Free text	Compliance officer or governance committee
tags	string[]	Array of strings	Categorization tags (e.g. tags ["iso27001", "pci"])
classification	string	Free text	Internal policy classification level
status	string	e.g. "Active", "Under Review"	Operational lifecycle state
priority	enum	"Critical", "High", "Medium", "Low"	Governance priority tier
policy_type	enum	"Security", "Privacy", "Compliance", "Operational", "Data Governance", "Access Control", "AI Governance", "Risk Governance", "IT Governance", "Cloud Security", "Vendor Risk Management"	Domain classification
enforcement	enum	"Mandatory", "Advisory", "Automated", "Recommended", "Optional"	Adherence obligation level

---

Allowed Relationship Verbs & Targets

Verb	ArchiMate Relation	Allowed Target Entity Types
governed_by	Governance	policy, standard
influences	Influence	goal, kpi

---

Complete Example

policy pol_data_retention "Customer Data Retention Policy" {
    description "Requires customer PII to be purged exactly 7 years after account closure"
    policy_type "Privacy"
    enforcement "Mandatory"
    priority "Critical"
    status "Active"
    tags ["privacy", "gdpr", "compliance"]

    relationships {
        this influences goal_regulatory_compliance
    }
}