Every policy at Map.ca needs an owner, a version number, a review date, an approval status, and a change log. The doctrinal review cycles are: privacy, security, AI, civic, and child-safety policies every 6 months; terms, accessibility, partner, and ambassador policies annually; and incident-response and breach-response policies after every major incident.
This policy applies to every policy owner at Map.ca and to the engineering team that operates the Policies hub. The data schema in src/data/policy/items.ts enforces the versioning fields.
Requirements
- Assign an owner, version, effective date, and review cycle to every policy.
- Re-review policies on the schedule defined by their category.
- Maintain a public change log for every Layer-1 and Layer-2 policy.
Prohibitions
- Do not ship a policy without an owner and a review cycle.
- Do not let a policy go past its review date without a written re-review.