uip gov compliance-packs

Syntax and options for browsing the compliance pack catalog and managing per-tenant pack deployment state using `uip gov compliance-packs catalog` and `uip gov compliance-packs state`.

uip gov compliance-packs manages compliance packs — bundles of pre-built AOps policies mapped to the clauses of a named compliance framework (for example ISO 42001), toggled on for a tenant in one call instead of authoring each policy by hand. Two subcommand groups: catalog (browse the static, read-only pack catalog) and state (manage per-tenant/organization pack deployment). For the parent tool overview, see uip gov.

Note:

Typical flow: catalog list to discover packs → state enable tenant <target-id> <pack-id> to deploy → state get tenant <target-id> <pack-id> to verify.

Synopsis

uip gov compliance-packs catalog list
uip gov compliance-packs catalog get <pack-id>

uip gov compliance-packs state list <scope> <target-id>
uip gov compliance-packs state get <scope> <target-id> <pack-id>
uip gov compliance-packs state enable <scope> <target-id> <pack-id>
uip gov compliance-packs state disable <scope> <target-id> <pack-id>
uip gov compliance-packs state restore <scope> <target-id> <pack-id>
uip gov compliance-packs state coverage <scope> <target-id> <pack-id>

<scope> is tenant or organization on every state verb — tenant is the routinely-used level today. <target-id> is the tenant UUID (scope=tenant) or org ID (scope=organization). Every verb also accepts --login-validity <minutes>.

uip gov compliance-packs catalog

Browse the static compliance pack catalog. Read-only.

uip gov compliance-packs catalog list

List every pack loaded into the governance service, with summary counts.

Example

uip gov compliance-packs catalog list

Data shape (--output json)

{
  "Code": "CompliancePacksCatalogList",
  "Data": {
    "packs": [
      {
        "packId": "iso-42001-2023",
        "packName": "ISO 42001",
        "packLongName": "ISO/IEC 42001:2023 — AI Management System",
        "packVersion": "3.0.0",
        "description": "ISO/IEC 42001:2023 AI Management System pack.",
        "publishedAt": "2026-05-14T00:00:00Z",
        "summary": { "clauseCount": 14, "controlCount": 81, "deploymentPolicyCount": 7 }
      }
    ]
  }
}

Use packId with catalog get, state enable, or state disable.

uip gov compliance-packs catalog get

Full catalog detail: pack header, summary counts, deployment policies, and the full clause tree (clauses → editorial policies → controls). Returns 404 for an unknown packId.

Arguments

Name	Required	Purpose
<pack-id>	yes	Pack identifier (e.g. iso-42001-2023) — from catalog list.

Example

uip gov compliance-packs catalog get iso-42001-2023

Data shape (--output json)

{
  "Code": "CompliancePacksCatalogGet",
  "Data": {
    "packId": "iso-42001-2023",
    "packName": "ISO 42001",
    "packVersion": "3.0.0",
    "summary": { "clauseCount": 14, "controlCount": 81, "deploymentPolicyCount": 7 },
    "deploymentPolicies": [{ "productIdentifier": "AITrustLayer", "productDisplayName": "AI Trust Layer", "policyName": "iso-42001-2023-ai-trust-layer", "policyFile": "policies/ai-trust-layer.json" }],
    "clauses": [{ "clauseId": "6.1.4", "clauseName": "AI system impact assessment", "productCount": 1, "controlCount": 3, "editorialPolicies": [] }]
  }
}

uip gov compliance-packs state

Per-tenant (or per-organization) pack deployment state: enable/disable a pack, inspect its current state, restore it to suggested defaults, or check coverage against what's already deployed.

uip gov compliance-packs state list

List every pack state recorded at a scope. Returns [] if nothing has been enabled/disabled yet.

Arguments

Name	Required	Purpose
<scope>	yes	tenant or organization.
<target-id>	yes	Tenant UUID or org ID matching <scope>.

Example

uip gov compliance-packs state list tenant 7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b

Data shape (--output json)

{
  "Code": "CompliancePacksStateList",
  "Data": [
    {
      "packStateId": "a1b2c3d4-0000-0000-0000-000000000001",
      "scopeLevel": "tenant",
      "scopeTargetId": "7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b",
      "packId": "iso-42001-2023",
      "packVersion": "3.0.0",
      "active": true,
      "lastToggledAt": "2026-05-14T10:00:00Z",
      "lastToggledBy": "user-uuid-here"
    }
  ]
}

uip gov compliance-packs state get

Get state detail for one pack, including associated Aops/Access policy IDs. 404 if no state row exists.

Arguments

Name	Required	Purpose
<scope>	yes	tenant or organization.
<target-id>	yes	Tenant UUID or org ID.
<pack-id>	yes	Pack identifier — from catalog list.

Example

uip gov compliance-packs state get tenant 7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b iso-42001-2023

Data shape (--output json)

{
  "Code": "CompliancePacksStateGet",
  "Data": {
    "packStateId": "a1b2c3d4-0000-0000-0000-000000000001",
    "scopeLevel": "tenant",
    "scopeTargetId": "7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b",
    "packId": "iso-42001-2023",
    "packVersion": "3.0.0",
    "active": true,
    "lastToggledAt": "2026-05-14T10:00:00Z",
    "lastToggledBy": "user-uuid-here",
    "policies": [{ "policyType": "Aops", "externalPolicyId": "ext-policy-uuid-here" }]
  }
}

uip gov compliance-packs state enable

Enable (or re-enable) a pack for a scope. Idempotent. On first enable, POSTs the pack's product policies to Aops and persists the resulting policy IDs. RBAC: Policy:Write required.

Arguments

Same three (<scope>, <target-id>, <pack-id>) as state get.

Example

uip gov compliance-packs state enable tenant 7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b iso-42001-2023

Data shape (--output json)

Same shape as state get, with Code: "CompliancePacksStateEnable".

A 404 on packId means it's not in the loaded catalog — check catalog list.

uip gov compliance-packs state disable

Disable a pack at a scope. Idempotent (no-op if already inactive). Removes the tenant assignments from Aops for the pack's associated policies. 404 if no state row exists. RBAC: Policy:Write required.

Arguments

Same three as state get.

Example

uip gov compliance-packs state disable tenant 7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b iso-42001-2023

Data shape (--output json)

{ "Code": "CompliancePacksStateDisable", "Data": { "Status": "Disabled" } }

uip gov compliance-packs state restore

Reset an active pack's Aops policies to the bundle's suggested values: in-place config reset for live policies, recreates any deleted policy, and re-asserts tenant bindings. Custom (Rego) policies are untouched. RBAC: Policy:Write required.

Note:

Returns a 409 for two indistinguishable cases: the pack isn't active yet at this scope (run state enable first), or another operation on it is currently in progress (wait and retry). The CLI surfaces both possibilities in the error Instructions.

Arguments

Same three as state get.

Example

uip gov compliance-packs state restore tenant 7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b iso-42001-2023

Data shape (--output json)

Same shape as state get, with Code: "CompliancePacksStateRestore".

uip gov compliance-packs state coverage

Compare a pack against a tenant's currently-deployed policies — which deployment policies/clauses are already "in-place" vs. "new" (would change something if enabled). Does not require the pack to be enabled first; computed fresh against live Aops state on every call. RBAC: Policy:Read required.

Arguments

Same three as state get.

Example

uip gov compliance-packs state coverage tenant 7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b iso-42001-2023

Data shape (--output json)

{
  "Code": "CompliancePacksStateCoverage",
  "Data": {
    "packId": "iso-42001-2023",
    "scopeLevel": "tenant",
    "scopeTargetId": "7d0f1e34-9a4b-4d7a-9a3c-2b3e4d5f6a7b",
    "summary": { "deploymentPolicyCount": 5, "inPlaceCount": 2, "newCount": 3 },
    "deploymentPolicies": [
      { "productIdentifier": "AITrustLayer", "status": "new" },
      { "productIdentifier": "Robot", "status": "in-place" }
    ],
    "clauses": [
      { "clauseId": "6.1.4", "status": "needs-policies" },
      { "clauseId": "A.4.5", "status": "in-place" }
    ]
  }
}

A 502 means the Aops state couldn't be fetched for the comparison.

Related

• uip gov — tool overview and Access Policies.
• aops-policy — the policies a pack bundles.
• aops-policy deployment and deployed-policy — assign and resolve policies directly.

See also

• Tools (plugins)
• Global options
• Exit codes