Review deletes and exports outside business hours

Covers: Any industry (operational control)

Use in VulnifyOpens in monitor mode by default. Nothing is created until you click Apply.

What it does

Deletes and exports outside Monday to Friday, 09:00 to 18:00 in your org time zone wait for approval. Ships in monitor mode.

Default mode in this template: MONITOR. The “Use in Vulnify” link preselects monitor mode; you can switch to enforce before applying.

Policy

Policy JSON (API)

{
  "name": "review-off-hours-deletes-and-exports",
  "description": "Deletes and exports outside Monday to Friday, 09:00 to 18:00 in your org time zone wait for approval. Ships in monitor mode.",
  "enabled": true,
  "action": "ANY",
  "condition": {
    "outsideBusinessHours": true,
    "anyOf": [
      {
        "action": "DELETE_DATA"
      },
      {
        "action": "EXPORT_DATA"
      }
    ]
  },
  "decision": "REVIEW",
  "mode": "MONITOR"
}

Policy YAML (CLI policy file)

apiVersion: vulnify.io/v1
kind: Policy
metadata:
  name: review-off-hours-deletes-and-exports
spec:
  description: "Deletes and exports outside Monday to Friday, 09:00 to 18:00 in your org time zone wait for approval. Ships in monitor mode."
  enabled: true
  action: ANY
  condition:
    outsideBusinessHours: true
    anyOf:
      - action: DELETE_DATA
      - action: EXPORT_DATA
  decision: REVIEW
  mode: MONITOR

Example test cases

Case	Input	Expected decision
export at 03:00 (depends on run time)	`{"agent":"example-agent","action":"EXPORT_DATA","resource":"orders-db","recordsAffected":50}`	REVIEW if run outside business hours (monitor mode: recorded, action allowed)

Try this template on your own agents, in monitor mode first.

Use in Vulnify

Not legal advice. These templates are starting points to help you design internal controls for AI agents. They are not legal advice and do not make your organization compliant with LGPD, GDPR, HIPAA or any other law or regulation. Review them with your own legal and compliance team before relying on them. Templates are provided “as is”, without warranty. Whether a rule matches depends on how you classify your resources and on the data your agents send; test in monitor mode before enforcing.

License: the templates are dedicated to the public domain under CC0 1.0. “Vulnify” is a trademark; the CC0 dedication does not cover the Vulnify name or logo.