How to build policy attestation tracking

What matters here

• Assign continuously from the HRIS, not in campaigns. A campaign leaves every subsequent joiner unattested.
• Record the policy version accepted. An attestation against a policy that has since changed proves nothing about the current one.
• Chase only the people outstanding. Reminding everybody trains the compliant to ignore you.
• Keep evidence per person per version. An auditor asks who accepted what, not what the completion rate was.
• A material policy change re-triggers attestation. A silent update makes every prior acceptance meaningless.

Who this is for

You run compliance, security or people operations. Policies are attested in an annual push, joiners are caught late, and the evidence is assembled under pressure when somebody asks.

How it works in practice

What happens between a policy existing and being able to prove people accepted it.

1. 1

   Assignment rules run continuously

   Department, role, level, location and system access decide who needs which policy.

2. 2

   A joiner is assigned on their start date

   Not at the next annual round, which is where the gap comes from.

3. 3

   The exact version is shown and recorded

   With a hash, so what was accepted is reconstructable years later.

4. 4

   Chasing targets only the outstanding

   Escalating to a manager rather than reminding everybody.

5. 5

   A material change re-triggers attestation

   A typo fix does not; a change of obligation does, and somebody decides which it is.

6. 6

   Evidence is per person per version

   Who accepted what, when, from where, ready for the question when it comes.

Paste these into Claude Code or Codex with the Tray Headless plugin installed. Each stage runs on its own. The systems named in them are the worked example rather than a requirement, and every prompt says so.

Once per project, run /tray-workflows:set-workspace to pick the workspace these build in. Point it at a sandbox first.

1. 1

   First, make assignment a rule, not a list

   A list is a snapshot and joiners are missing from it.

   Headless skills build-workflow

   Copy

   Use build-workflow. The systems in play are Workday and Okta, or
   whatever we run in those seats.
   
   Build assignment as rules over attributes rather than as a list of
   people:
   
     Everybody: code of conduct, security policy, acceptable use
     Engineering: secure development, change management
     Finance and anybody with system access: segregation of duties
     Anybody handling personal data: data protection
     Regulated roles by jurisdiction: whatever applies there
   
   Evaluate continuously against the HRIS instead of in a campaign. A
   campaign is a snapshot, and everybody who joins afterwards is missing
   from it until the next one, which is where the audit gap comes from.

2. 2

   Version what was accepted

   An attestation against a superseded policy proves nothing about the current one.

   Headless skills build-workflow

   Copy

   Use build-workflow. Every policy is a versioned document with an
   effective date and a content hash.
   
   Record on each attestation: the person, the policy, the exact version and
   its hash, the timestamp, and the method of acceptance.
   
   Store the document version itself, not a link to the current one. A link
   resolves to whatever the policy says today, which proves nothing about
   what somebody agreed to two years ago.
   
   An attestation is only evidence for the version it was made against.
   Anything else is a completion statistic dressed up as a control.

3. 3

   Chase the outstanding, not everybody

   Reminding everybody teaches the compliant to ignore you.

   Copy

   Assign with a due date from the start date or the policy publication,
   then chase only those outstanding:
   
     Day 7: a reminder to the person
     Day 14: a reminder copying their manager
     Day 21: escalation to the department head with the list
     Day 30: to compliance as a breach of the policy itself
   
   Never send a reminder to somebody who has already completed. It is the
   fastest way to make people filter your messages, and then the real
   escalations go unread too.
   
   Report by department and manager instead of as a company number.
   Outstanding attestations concentrate in specific teams, and a company
   average hides that entirely.

   Escalating to the manager at day 14, not day 30 is what actually moves completion. Most non-completion is forgetting, not refusal.

4. 4

   Handle change, leave and exceptions

   A silent policy update makes every prior acceptance meaningless.

   Headless skills tray-gotchas tray-patterns

   Copy

   Use tray-gotchas, then handle these:
   
   A material policy change re-triggers attestation for everybody it applies
   to. A typographical fix does not. Somebody decides which it is at publish
   time, and that decision is recorded.
   
   A role change re-evaluates assignment. Somebody moving into finance
   acquires the segregation of duties policy that day.
   
   A leaver stops being chased but their attestation history is retained,
   because the question is about the period they worked here.
   
   Somebody on long leave is excluded from chasing and reassigned on return
   rather than accruing an overdue record they could never have completed.
   
   A refusal is an escalation to compliance, not a retry loop.

5. 5

   Produce evidence, not a percentage

   An auditor asks who accepted what.

   Copy

   Produce the evidence continuously instead of assembling it when asked:
   
     Per person: every policy, version and acceptance date
     Per policy version: everybody who accepted it and when
     Currently outstanding, with age and owner
     People who joined and were assigned within their first week
     Policy versions published without an attestation decision recorded
   
   Report coverage by department and by policy, and time from assignment to
   completion.
   
   Do not lead with a company completion percentage. It sits near ninety
   five, moves slowly, and hides the department at sixty which is the only
   part anybody needs to act on.

6. 6

   Test it, then hand the rules to compliance

   Because policies and their audiences change constantly.

   Copy

   Run the per-step schema checks and the whole-workflow audit before this
   touches production.
   
   Then open the same workflow in Tray Build so compliance can maintain the
   assignment rules, the chase cadence and the material-change decision in
   the visual canvas.

What it connects to

People come from the HRIS, policies from a document store, and evidence has to outlive both.

Named systems are the ones most teams run, not the only ones that work. Each is an authentication in your Tray workspace, referenced by name, so the workflow never holds a credential. Where we have a connector page, the name links to it.

Questions people ask

Related guides