> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Write your remediation policy

> Draft, publish, and maintain the written mandate that defines what Primo AI is allowed to do on your compliance tickets.

The compliance remediation policy is a written document, in Markdown, that Primo AI reads before it touches any ticket. Without a published policy it acts on nothing. Publishing it is what switches auto remediation on.

A policy can only ever **narrow** what Primo AI does. No sentence in it grants an action the product forbids — see [Limits and platform constraints](/mdm/compliance/remediation-limits).

## Write it with the assistant

The policy page carries an embedded Primo AI chat. It interviews you and writes the policy for you, grounded in your real compliance rules, your MDM controls, and your fleet — so the draft references the issue types you actually have rather than a generic list.

<Steps>
  <Step title="Open the policy">
    Go to **Compliance > Compliance issue settings** and open the remediation policy.
  </Step>

  <Step title="Answer the assistant's questions">
    It asks which issues you want worked, how far Primo AI should go on its own, and how it should talk to your employees.
  </Step>

  <Step title="Review the draft">
    The draft is yours to edit directly. The assistant writes it; it does not own it.
  </Step>

  <Step title="Publish">
    Publishing switches auto remediation on and the state chip reads Auto remediation: ON.
  </Step>
</Steps>

## Cover the four sections

The policy template is always the same four sections.

### Scope

Which issues Primo AI works, and which it never touches. Name them the way they appear in your settings.

### What Primo AI does on its own

The fixes it applies without asking, and the cases it hands straight back to your team.

### Talking to employees

When it may write to an employee, in which tone and language, and how many messages. Primo AI writes once per issue by default — say so here if you want it narrower.

### Company knowledge

Facts about your fleet that change how an issue should be read: which Linux distributions you run, which office's network blocks the agent, which devices are held in stock, which teams are never written to directly. Primo AI adds to this section itself over time, on an admin's confirmation — see [Read a compliance ticket](/mdm/compliance/remediation-tickets).

## Example policy

Use this as a starting point, then replace every line with your own reality.

```markdown theme={null}
## Scope

Work encryption, OS update, EDR, admin account and profile delivery issues on
macOS and Windows laptops.

Never work issues on devices in the Warehouse device group — those are held in
stock and are expected to be offline and unencrypted.

Never work iCloud lock issues. Route them to IT untouched.

## What Primo AI does on its own

Re-push configuration profiles, re-run control scripts, and re-install missing
software without asking.

Hand back to IT, without attempting a fix:
- any device that has been offline for more than 7 days
- any issue on a device that has already had 3 tickets on the same rule
- anything requiring a purchase, a licence, or a re-enrollment

## Talking to employees

Write to the employee only when the operating system needs them at the keyboard,
and only after everything that can be done remotely has been done.

One message per issue. Write in the employee's language. Never name an internal
control or a Primo screen.

Never write to employees in the Executive team — raise those to IT instead.

## Company knowledge

Our Linux fleet is Ubuntu 22.04 LTS only.
The Berlin office guest network blocks the agent; devices there sync over VPN only.
Devices named PRIMO-STOCK-* are held in stock and have no assigned employee.
```

## Maintain it over time

* The policy has a draft and a published version. Editing the draft changes nothing until you publish.
* Unpublishing turns auto remediation off for new tickets. Tickets already assigned to Primo AI stop with a note rather than acting.
* When Primo AI adds a fact to **Company knowledge** on your approval, the change is recorded as made by Primo AI, and its note names the admin who approved it.
* If you have unfinished draft edits, Primo AI saves its addition but skips the publish, and says so.

## Contact

If the policy assistant cannot see your rules or controls, or publishing does not switch the state chip to ON, contact [support@getprimo.com](mailto:support@getprimo.com) with:

* Your company name
* The time you published
* A screenshot of the state chip

## Related articles

* [Set up auto remediation](/mdm/compliance/remediation-setup)
* [What Primo AI does on a compliance ticket](/mdm/compliance/primo-ai-remediation)
* [Limits and platform constraints](/mdm/compliance/remediation-limits)