# Kapi Works policies

> Write Kapi Works policies that people acknowledge or sign: the policy format, the place to sign, what Kapi keeps and leaves out, six example policies and the prompt for your own AI.

- Format: kapi.works.policy/2. One HTML file; Kapi reads any HTML into the format and stores one canonical file.
- Kapi's example policies, each the canonical file as Kapi stores it: https://docs.kapiworks.com/build/examples/policies/code-of-conduct.html, https://docs.kapiworks.com/build/examples/policies/preventing-sexual-harassment.html, https://docs.kapiworks.com/build/examples/policies/using-ai-at-work.html, https://docs.kapiworks.com/build/examples/policies/data-protection-at-work.html, https://docs.kapiworks.com/build/examples/policies/partner-code-of-conduct.html, https://docs.kapiworks.com/build/examples/policies/customer-terms-of-use.html
- The prompt for your own AI: https://docs.kapiworks.com/build/policies#the-prompt
- Every page below is also Markdown: add .md to its address, or send Accept: text/markdown.
- Docs MCP server (streamable HTTP, read-only): https://docs.kapiworks.com/api/mcp, with get_policy_format.

# Policies

Make Kapi Works policies that people acknowledge or sign. Write one with Kapi or with your own AI, start from an example, or upload HTML, Word or PDF.

A Kapi Works policy is one HTML file in Kapi's [policy format](https://docs.kapiworks.com/build/policies/format): headings, paragraphs, lists, tables and links, with a place to sign. Employees acknowledge a policy with one tick and one button. Partners and customers acknowledge it the same way, or sign it with their signature. Everyone gets a signed copy as a PDF.

Policies are not training. They stay out of courses lists, results, certificates and the training register.

## Make a policy

In Works Studio, press **Create**, then **Policy**. **New policy** opens with three ways in:

* **Write it with Kapi.** Describe the policy, or add your documents, and Kapi writes it in the policy format.
* **Copy prompt for your AI.** Copies [the prompt](#the-prompt) with Kapi's example code of conduct below it, for ChatGPT, Claude, Gemini or any AI. Paste it into your AI, answer its questions, then upload what it makes.
* **Upload your policy.** Paste HTML, or choose an HTML, Word or PDF file. Your browser turns a Word or PDF file into the policy format with code, not AI.

Below them are Kapi's six [example policies](#examples). **Have a look** shows one as people will see it, **Use this** starts a draft from it, and **Copy prompt** copies a prompt for a policy like it.

Every way in opens the editor. It shows the policy as people will see it, place to sign included, at desktop or phone width. **HTML** opens the file beside it to edit, and clicking a part of the policy selects its HTML. Ask Kapi for bigger changes in words, such as "add a section on gifts". Kapi's checks list what Kapi changed in the file and anything that stops publishing. A policy Kapi wrote, or one started from an example, shows "Written by Kapi. Check it with your adviser before you publish." in the editor only. **Continue** opens the policy's page.

## Publish and share

The policy's page has three tabs: **Document**, **People** and **Settings**. On **Settings**, choose:

* what people do: **Acknowledge**, or **Sign**;
* the statement they agree to;
* who may receive it: employees, partners or customers;
* whether to ask again every year, every 2 years or every 3 years;
* when it takes effect.

The [two tags](https://docs.kapiworks.com/build/policies/format#who-receives-it-and-what-they-do) in a file suggest what people do and who receives it. You decide before you publish.

**Publish** makes the policy live. When you publish a later version, choose whether everyone signs again or it is a small fix that nobody signs again. Then share it from the **People** tab with people or groups. Each audience has a group called **Everyone**, which new starters join as they arrive. A policy is always required. Its deadline is a number of days after it reaches each person, 14 unless you change it, or a date you choose.

## Acknowledging and signing

People find the policy in Works Learn, on Home and in My learning. They read it, then act where the policy puts its place to sign.

* **Acknowledge.** They tick the statement, then press **Acknowledge**.
* **Sign.** **Sign here** opens **Your signature**. They draw it with a mouse, finger or pen, or type their name, and can save it for next time. Their name, their company and today's date fill in, and **Sign** completes it.

Each person acknowledges or signs for themselves. Kapi records no reading time and sets no timers.

## The signed copy

Each act gives a signed copy as a PDF: the policy as the person read it, with their tick or signature where the policy puts its place to sign, then a **Signing record** page. The record lists the policy, the company, the version, the person and their email, their company, what they did, when it happened in their time zone and in UTC, how they signed in, the statement, the [document fingerprint](https://docs.kapiworks.com/build/policies/format#the-canonical-file) and the receipt. The same receipt always gives the same PDF.

People download their copy when they finish, and find it later in **Your records**. The company sees who has acknowledged or signed, downloads each signed copy and reminds the rest. Auditors read the same records in their portal, and your own systems read them through the Works API with the `acknowledgements:read` scope, starting with [`GET /v1/acknowledgements`](https://docs.kapiworks.com/reference/list-acknowledgements).

## Examples

Each example is written for a UK company of 50 to 250 people, in plain words, with its sources. Each file is the canonical file, exactly as Kapi stores it.

| Example | Who and what | File |
| --- | --- | --- |
| Code of conduct | Employees · Acknowledge · About 5 minutes | [`code-of-conduct.html`](https://docs.kapiworks.com/build/examples/policies/code-of-conduct.html) |
| Preventing sexual harassment policy | Employees · Acknowledge · About 5 minutes | [`preventing-sexual-harassment.html`](https://docs.kapiworks.com/build/examples/policies/preventing-sexual-harassment.html) |
| Using AI at work policy | Employees · Acknowledge · About 4 minutes | [`using-ai-at-work.html`](https://docs.kapiworks.com/build/examples/policies/using-ai-at-work.html) |
| Data protection at work policy | Employees · Acknowledge · About 5 minutes | [`data-protection-at-work.html`](https://docs.kapiworks.com/build/examples/policies/data-protection-at-work.html) |
| Partner code of conduct | Partners · Sign · About 4 minutes | [`partner-code-of-conduct.html`](https://docs.kapiworks.com/build/examples/policies/partner-code-of-conduct.html) |
| Customer terms of use | Customers · Acknowledge · About 4 minutes | [`customer-terms-of-use.html`](https://docs.kapiworks.com/build/examples/policies/customer-terms-of-use.html) |

## The prompt

**Copy prompt for your AI** copies this prompt, with Kapi's example code of conduct below it, shortened to fit. An example's **Copy prompt** copies the same prompt for a policy like that example. Your AI asks you up to five questions, then writes one HTML file.

```text
Kapi Works policy prompt · any policy · format 2

Write a policy for Kapi Works, my company's learning platform, where people acknowledge or sign it. Answer with one complete HTML file in one code block, in Kapi's policy format. Kapi reads it, shows it as people will see it, and I check it before I publish.

THE FORMAT
- One HTML file: <!doctype html>, <html lang="en-GB">, then a head with <meta charset="utf-8">, the two tags below and a <title>.
- <meta name="kapi:act" content="acknowledge"> when people tick to confirm they have read it, or content="sign" when they sign it with their signature. <meta name="kapi:signers" content="employees"> says who receives it: any of employees, partners and customers.
- The body uses only h1 to h4, p, ul, ol, li, blockquote, table with caption, tr, th and td, hr, strong, em, a href and br. Kapi leaves out styles, classes, scripts, pictures, forms and frames.
- One h1, the title. Then short sections, each under an h2.
- <kapi-sign></kapi-sign> once, where people acknowledge or sign: usually at the end, after a sentence that says what they confirm. Kapi draws a tick box there, or a signature box with the person's name and the date.
- Links start with https:// or mailto:.

RULES
1. Plain UK English: short sentences, "you" for the reader and "we" for my company.
2. Take rules, numbers and contacts only from my documents and my answers. If they don't say, ask me.
3. Link official sources over https, such as gov.uk, acas.org.uk, ico.org.uk and legislation.gov.uk. Never invent a law, a date, a case or a source.
4. Never say the policy or the company is compliant, certified or legally binding, or that signing proves anything. Say what people do.
5. Name roles and team contacts, such as "your manager" or a team's email address, not individual people.
6. Give the whole file. Never shorten it or write "…".

If you can open web pages, read https://docs.kapiworks.com/build/policies/llms.txt first.
Ask me up to five questions first, such as what the policy covers, who receives it, whether they acknowledge or sign it, and who they contact with questions. Then write the file.
```

For your AI, the whole policy format is one plain text file at `https://docs.kapiworks.com/build/policies/llms.txt`. [For AI agents](https://docs.kapiworks.com/build/ai) lists everything else.

## Find your way

- [Policy format](https://docs.kapiworks.com/build/policies/format): Every element Kapi keeps, the place to sign, the two tags and the canonical file.
- [For AI agents](https://docs.kapiworks.com/build/ai): Prompts, examples and plain text files for your AI.


# Policy format

What Kapi reads in a policy file. The elements it keeps, the place to sign, the two tags, what it leaves out, the limits and the canonical file.

A policy is one HTML file. Kapi reads any HTML into its policy format, `kapi.works.policy/2`, says in plain words what it changed, and stores the result as one canonical file. People read that file, sign it and get it back as a PDF, so what someone signs is exactly what they saw.

## A whole policy

A short policy, as your AI writes it:

```html
<!doctype html>
<html lang="en-GB">
<head>
<meta charset="utf-8">
<meta name="kapi:act" content="acknowledge">
<meta name="kapi:signers" content="employees">
<title>Gifts and hospitality policy</title>
</head>
<body>
<h1>Gifts and hospitality policy</h1>
<p>Gifts and hospitality must not influence a decision, or look as though they could.</p>
<h2>What to do</h2>
<table>
  <caption>Gifts and hospitality, given or received</caption>
  <tr><th>What</th><th>What to do</th></tr>
  <tr><td>Worth up to £50</td><td>You may give or accept it.</td></tr>
  <tr><td>Worth more than £50</td><td>Ask your manager first, and record it in the gifts register.</td></tr>
</table>
<h2>Find out more</h2>
<ul>
  <li><a href="https://www.gov.uk/government/publications/bribery-act-2010-guidance">GOV.UK: Bribery Act 2010 guidance</a></li>
  <li>Questions: <a href="mailto:hr@example.com">hr@example.com</a></li>
</ul>
<h2>Confirming you have read this policy</h2>
<p>Confirm below that you have read this policy.</p>
<kapi-sign></kapi-sign>
</body>
</html>
```

## What Kapi keeps

| Element                              | For                                                                                                 |
| ------------------------------------ | --------------------------------------------------------------------------------------------------- |
| `h1`                                 | The title. The first `h1` is the policy's title.                                                    |
| `h2`, `h3`, `h4`                     | Section headings. Kapi reads `h5` and `h6` as `h4`.                                                 |
| `p`                                  | Paragraphs.                                                                                         |
| `ul`, `ol`, `li`                     | Lists, up to four levels deep. An `ol` keeps its `start` and its `type`: `1`, `a`, `A`, `i` or `I`. |
| `blockquote`                         | Quoted words.                                                                                       |
| `table`, `caption`, `tr`, `th`, `td` | Tables. Header cells are `th`.                                                                      |
| `hr`                                 | A line between parts.                                                                               |
| `strong` or `b`, `em` or `i`         | Bold and italic words.                                                                              |
| `a href`                             | Links to `https://` pages and `mailto:` addresses.                                                  |
| `br`                                 | A line break.                                                                                       |
| `kapi-sign`                          | The place to sign.                                                                                  |

Containers such as `div`, `section`, `article`, `header` and `footer` keep what they hold. Every other element keeps its words.

## The place to sign

`<kapi-sign></kapi-sign>` marks where people acknowledge or sign. Kapi draws the place to sign there: the statement, then a tick and **Acknowledge**, or a signature, name, company and date and **Sign**. Put it after a sentence that says what people confirm, usually at the end.

A file without one gets one at the end. With more than one, Kapi keeps the first. One inside a sentence, a list or a table moves to just after it.

## Who receives it and what they do

Two optional tags in the head suggest how the policy starts:

```html
<meta name="kapi:act" content="acknowledge">
<meta name="kapi:signers" content="employees, partners, customers">
```

* `kapi:act` is `acknowledge`, for a tick and **Acknowledge**, or `sign`, for a signature.
* `kapi:signers` names any of `employees`, `partners` and `customers`.

Kapi starts the policy's settings from them, and you decide before you publish. The tags stay out of the canonical file.

## Title and language

The title is the first `h1`, else the file's `title`, else the file's name. The language is the `lang` of `html`, else `en-GB`.

## What Kapi leaves out

Kapi leaves out scripts, styles and classes, pictures and media, frames, form fields, and link targets that do not start with `https://` or `mailto:`. It keeps the words people should read, and shows hidden words. Kapi's checks list each change in these words:

| In the file | What Kapi says |
| --- | --- |
| Scripts | Kapi left out a script. Policies don't run code. |
| Styles, stylesheets and classes | Kapi left out the file's styling. Policies use Kapi's reading style, with text size and Listen. |
| Pictures, video, sound and embedded frames | Kapi left out a picture or embedded item. Policies hold words only. |
| Form fields and buttons | Kapi left out a form field. People sign in Kapi's own place to sign. |
| Links that do not start with https:// or mailto: | Kapi kept the words of a link that didn't start with https:// or mailto:, without the link. |
| Hidden words | Some words were hidden in the file. Kapi shows them, so people see everything they sign. |
| Merged table cells | Kapi split merged table cells, so each cell holds its own words. |
| Lists more than four levels deep | Kapi kept lists 4 levels deep and joined deeper levels to the level above. |
| A second place to sign | Kapi kept the first place to sign and left out the other one. |
| A title but no main heading | Kapi added the title as the main heading at the top. |
| No place to sign | Kapi added the place to sign at the end. |

These stop publishing until they are fixed:

| In the file | What Kapi says |
| --- | --- |
| No words | The policy has no words yet. |
| No main heading and no title | Add a title: a main heading at the top of the policy. |
| A main heading over 300 characters | Shorten the main heading to 300 characters or fewer. |
| More than 250,000 characters of words | This policy is too long. A policy holds at most 250,000 characters of words. |
| More than 2,000,000 characters of HTML | This file is too large for a policy. A policy holds at most 2 MB of HTML. |
| A file that is not a web page, such as a Word file renamed .html | Kapi couldn't read this as a web page. Save it as HTML, or upload it as Word or PDF. |

## Limits

| Limit | Value |
| --- | --- |
| HTML Kapi reads | 2,000,000 characters, about 2 MB |
| Words in a policy | 250,000 characters |
| Main heading | 300 characters |
| Levels in a list | 4 |

## The canonical file

Kapi stores only canonical files: `<!doctype html>`, `<html lang>`, a head with the charset and the title, then one block per line, with nested list items indented by two spaces. The same document always gives the same bytes. The policy above, as Kapi stores it:

```html
<!doctype html>
<html lang="en-GB">
<head>
<meta charset="utf-8">
<title>Gifts and hospitality policy</title>
</head>
<body>
<h1>Gifts and hospitality policy</h1>
<p>Gifts and hospitality must not influence a decision, or look as though they could.</p>
<h2>What to do</h2>
<table>
  <caption>Gifts and hospitality, given or received</caption>
  <tr><th>What</th><th>What to do</th></tr>
  <tr><td>Worth up to £50</td><td>You may give or accept it.</td></tr>
  <tr><td>Worth more than £50</td><td>Ask your manager first, and record it in the gifts register.</td></tr>
</table>
<h2>Find out more</h2>
<ul>
  <li><a href="https://www.gov.uk/government/publications/bribery-act-2010-guidance">GOV.UK: Bribery Act 2010 guidance</a></li>
  <li>Questions: <a href="mailto:hr@example.com">hr@example.com</a></li>
</ul>
<h2>Confirming you have read this policy</h2>
<p>Confirm below that you have read this policy.</p>
<kapi-sign></kapi-sign>
</body>
</html>
```

The document fingerprint is the lower-case hex SHA-256 of the canonical file's UTF-8 bytes. Each receipt and each signed copy records it, so a copy can be matched to the version it was signed against. Kapi's [example code of conduct](https://docs.kapiworks.com/build/examples/policies/code-of-conduct.html) has the fingerprint `710e4f0ccc6f0e414a3b6f51a35dc1ee93f9fb9afbd121933f3f1d6270c842bd`. To check it yourself:

```sh
curl -s https://docs.kapiworks.com/build/examples/policies/code-of-conduct.html | shasum -a 256
```

# Kapi's example: Code of conduct

Employees · Acknowledge · About 5 minutes. The whole file as an author's AI writes it, with its two tags. Kapi stores it without them, at https://docs.kapiworks.com/build/examples/policies/code-of-conduct.html.

```html
<!doctype html>
<html lang="en-GB">
<head>
<meta charset="utf-8">
<meta name="kapi:act" content="acknowledge">
<meta name="kapi:signers" content="employees">
<title>Code of conduct</title>
</head>
<body>
<h1>Code of conduct</h1>
<p>This code sets out how we expect everyone who works here to behave. It applies to employees, workers, agency workers and contractors: at work, at work events, when you work from home, online, and whenever you represent the company.</p>
<p>No code can cover every situation. If you are not sure what to do, ask yourself whether it is honest, fair, safe and lawful, and whether you would be happy to explain it to a colleague. If you are still not sure, ask your manager or HR.</p>
<h2>Treat people with respect</h2>
<ul>
  <li>Treat everyone with dignity and courtesy: colleagues, customers, partners and visitors.</li>
  <li>Do not harass, bully or discriminate against anyone. This includes remarks, jokes, messages and images, in person or online.</li>
  <li>Our <strong>Preventing sexual harassment policy</strong> explains what sexual harassment is and how to report it.</li>
</ul>
<h2>Be honest</h2>
<ul>
  <li>Be honest in your work, in your records and in what you say about the company.</li>
  <li>Keep accurate records, and do not change or destroy a record to hide a mistake.</li>
  <li>Do not offer, give, ask for or accept a bribe of any kind, directly or through someone else. A bribe is anything of value offered to make someone act improperly.</li>
  <li>If someone asks you for a bribe, or for a payment that seems wrong, refuse and tell your manager or HR straight away. You will not be in trouble for refusing, even if we lose business as a result.</li>
</ul>
<h2>Deal fairly with customers, suppliers and competitors</h2>
<ul>
  <li>Describe our products and services honestly. Do not promise a customer anything the company has not agreed to.</li>
  <li>Choose suppliers on quality, price and service, following our buying process.</li>
  <li>Do not agree with a competitor on prices, discounts, bids or which customers each of you serves, and do not share our prices or plans with competitors. Agreements like these are against competition law, even when they are informal.</li>
</ul>
<h2>Company money</h2>
<p>Spend company money only for business purposes. Follow our expenses rules, claim only what you have paid for work, and keep your receipts. Ask your manager before you commit the company to a cost you are not sure about.</p>
<h2>Conflicts of interest</h2>
<p>A conflict of interest is when your personal interests could affect your decisions at work, or could look as though they do. Examples include a second job, a close relative who works for a supplier, shares in a competitor, or a close personal relationship with someone you manage.</p>
<p>Tell your manager about a conflict as soon as you know about it, and agree with them how to handle it before you take part in any decision it affects. Declaring a conflict is not wrongdoing. Hiding one is.</p>
<h2>Gifts and hospitality</h2>
<p>Small gifts and modest hospitality are a normal part of business. They must not influence a decision, or look as though they could.</p>
<table>
  <caption>Gifts and hospitality, given or received</caption>
  <tr><th>What</th><th>What to do</th></tr>
  <tr><td>Worth up to £50</td><td>You may give or accept it. You do not need to record it.</td></tr>
  <tr><td>Worth more than £50</td><td>Ask your manager before you give or accept it, and record it in the gifts register.</td></tr>
  <tr><td>Cash, or anything that works like cash, such as vouchers</td><td>Do not give or accept it, whatever the amount.</td></tr>
  <tr><td>Anything from a supplier while we are choosing one</td><td>Politely decline it, and tell your manager it was offered.</td></tr>
</table>
<p>If you are not sure, ask your manager before you give or accept anything.</p>
<h2>Confidential information</h2>
<ul>
  <li>Keep confidential information safe. This includes information about the company, our customers, our partners and the people who work here.</li>
  <li>Share it only with people who need it for their work. Our <strong>Data protection at work policy</strong> explains how to handle personal data.</li>
  <li>Keep it confidential after you leave the company too.</li>
  <li>Nothing in this code stops you from blowing the whistle, reporting a crime or speaking to a regulator.</li>
</ul>
<h2>Company equipment and systems</h2>
<ul>
  <li>Use company equipment, systems and accounts for work. Occasional personal use is fine if it is brief, lawful and does not get in the way of your work.</li>
  <li>Keep your passwords to yourself, use two-step sign-in wherever it is offered, and lock your screen when you step away.</li>
  <li>Report a lost or stolen device, or a suspicious email, to IT at once.</li>
  <li>Return all company equipment when you leave.</li>
  <li>We may check how our systems are used, as our privacy notice for staff explains.</li>
</ul>
<h2>Social media and speaking for the company</h2>
<p>You may use social media in your own time. If you mention your work, make clear that your views are your own. Do not post confidential information, or anything that harasses or bullies colleagues, customers or partners, even from a personal account.</p>
<p>Only the people the company chooses may speak for it in public. Pass any questions from journalists to your manager.</p>
<h2>Health and safety</h2>
<ul>
  <li>Take reasonable care of your own health and safety, and of anyone affected by what you do or fail to do at work.</li>
  <li>Follow safety instructions and training, and use the safety equipment provided.</li>
  <li>Report accidents, near misses and hazards to your manager straight away.</li>
  <li>Tell your manager if anything, such as illness, tiredness or medication, affects your ability to work safely.</li>
</ul>
<h2>Alcohol and drugs</h2>
<p>Do not work under the influence of alcohol or illegal drugs. At work events where alcohol is served, drink responsibly: this code still applies. If a medicine you have been prescribed may affect your work, tell your manager. You do not have to say what it is.</p>
<h2>Speaking up</h2>
<p>Tell us if you see something wrong at work. This could be a crime, a danger to health or safety, damage to the environment, a breach of the law, sexual harassment, or someone covering any of these up.</p>
<p>You can tell your manager, HR or any director. The law protects workers who report certain kinds of wrongdoing in the public interest, which is called whistleblowing. You can also report to a prescribed person or body, such as a regulator.</p>
<p>We will not treat you badly for raising a genuine concern, even if you turn out to be mistaken. Treating someone badly for speaking up is a disciplinary matter.</p>
<h2>If this code is broken</h2>
<ul>
  <li>If you think someone has broken this code, tell your manager or HR, or use one of the routes in Speaking up.</li>
  <li>We look into concerns fairly and promptly, following our disciplinary procedure where it applies.</li>
  <li>Breaking this code may lead to disciplinary action, up to and including dismissal. For contractors, it may end the contract.</li>
  <li>Some breaches, such as bribery and fraud, may also be crimes. We may report them to the police.</li>
</ul>
<h2>Find out more</h2>
<ul>
  <li><a href="https://www.gov.uk/whistleblowing">GOV.UK: Whistleblowing for employees</a></li>
  <li><a href="https://www.gov.uk/government/publications/blowing-the-whistle-list-of-prescribed-people-and-bodies--2">GOV.UK: Whistleblowing, list of prescribed people and bodies</a></li>
  <li><a href="https://www.acas.org.uk/whistleblowing-at-work">Acas: Whistleblowing at work</a></li>
  <li><a href="https://www.gov.uk/government/publications/bribery-act-2010-guidance">GOV.UK: Bribery Act 2010 guidance</a></li>
  <li><a href="https://www.acas.org.uk/acas-code-of-practice-on-disciplinary-and-grievance-procedures">Acas: Code of Practice on disciplinary and grievance procedures</a></li>
</ul>
<h2>Confirming you have read this code</h2>
<p>We review this code every year, and sooner if the law or our business changes. We will tell you what has changed. Ask your manager or HR if anything in it is unclear, then confirm below that you have read it.</p>
<kapi-sign></kapi-sign>
</body>
</html>
```
