Operations & Compliance package
A monthly campaign: employees confirm they have read the policies due for them, with reminders, escalation to compliance and an audit trail of attestations.
About this package
Policy attestation runs your read-and-understood campaigns. On the first of each month it reads the Policies data table, picks the active policies whose next due date has arrived and lists active employees from your HR system.
Each employee gets their own Attest policy run with only the policies for their department plus the ones for everyone. They tick "I have read and understood" and attest, or raise a question; questions go to the compliance officer, who answers (the attestation goes back to the employee) or marks them exempt. Reminders go out before the due date, open requests escalate to the compliance officer after 10 days, and every attested policy is written to the Attestations table with the version and date. The policies' next due dates roll forward by their frequency and the compliance officer gets a campaign summary.
Adapt the Policies rows (audience is a department name or "all"), the HR system reference to your API, the schedule, and the reminder and escalation timings on the attestation step.
Monthly on day 1 at 08:00 (UTC). You can also start it any time from the Run dialog, the API or the CLI.
Runs on a schedule (daily, weekly, monthly) in your time zone.
The flow
Monthly campaign
On the 1st the workflow lists the active policies whose next due date has arrived. If none are due it stops.
Find the employees
List active employees returns everyone in the HR system with their department and email.
Match policies to people
For each employee the due policies are filtered to their department plus "all"; an Attest policy run starts for anyone with at least one.
Attest or ask
The employee ticks "I have read and understood" and attests, or raises a question. Reminders go out and open tasks escalate to compliance after 10 days.
Answer questions
The compliance officer answers (the attestation returns to the employee) or marks the employee exempt for this campaign.
Record and roll forward
Each policy is recorded in the Attestations table, the employee gets a receipt, next due dates move on by the policy frequency and compliance gets a summary.
Forms
The inputs a caller passes when it starts a run, and the forms people complete when the process needs a decision.
Start inputs
Passed by the calling system
User Task · Attest policy
Read and attest: {{policy_names}}
User Task · Attest policy
Policy question from {{employee.name}} ({{campaign_id}})
From your code
Every workflow can be started over REST, MCP or the CLI, whatever its trigger, with the sample input below. Runs start straight away on the published version; replace <workflow id> with the id the install created.
REST
curl -X POST "$USERTASKS_URL/api/v1/workflows/start" \
-H "Authorization: Bearer $USERTASKS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"workflow_id":"<workflow id>","variables":{"as_of":"2026-11-01","compliance_email":"compliance@example.com"}}'CLI
usertasks workflows inputs <workflow id> # the start form: keys, types, required
usertasks workflows run <workflow id> --input as_of=2026-11-01 --input compliance_email=compliance@example.com --waitWhat's included
| Type | Name | Details |
|---|---|---|
| Email template | Attestation campaign started | Sent to the compliance officer when the monthly campaign has gone out. |
| Email template | Policy attestation receipt | Sent to the employee once their attestation is recorded. |
| Data table | Attestations | One row per employee and policy attested in a campaign: the evidence trail for auditors. |
| Data table | Policies | The policies employees attest to: version, owner, document link, audience (a department or "all") and how often they are re-attested. Policies whose next due date has arrived are included in the monthly campaign. |
| Integration | HR system | |
| API reference | List active employees | GET /employees — Active employees from the HR system with department and work email. |
| Workflow | Attest policy | 16 steps — One employee's attestation in a campaign: the employee confirms the policies that apply to them; questions go to the compliance officer; each attested policy is recorded. |
| Workflow | Monthly policy attestation | 19 steps — On the first of each month: finds the policies due for attestation, lists active employees from the HR system and starts an Attest policy run for every employee the policies apply to. |
Attestations · schema only
CampaignPolicy IDPolicyVersionEmployee IDEmployeeEmailDepartmentStatusAttested atComments
Policies · 7 sample rows
Policy IDPolicyVersionPolicy ownerDocument URLAudience (department or all)Attestation frequencyDays between attestationsNext dueActive
Requirements
Credentials never travel in a package. The install wizard asks for what your environment must provide, or installs it incomplete until you finish setup.
Integration “HR system”Required
Workflow “Attest policy” assigneesRequired
Install
Works on UserTasks cloud and on any self-hosted instance. Installing creates the assets above; nothing runs until you complete setup and start it.
curl -fLO https://usertasks.com/gallery/policy-attestation-1.0.0.utpkg
usertasks packages inspect policy-attestation-1.0.0.utpkg # offline: checksum, hashes, signature
usertasks packages install policy-attestation-1.0.0.utpkg --dry-run
usertasks packages install policy-attestation-1.0.0.utpkg # prompts for each requirement
usertasks packages install policy-attestation-1.0.0.utpkg --keep-incomplete --yes # in CI; finish with:
usertasks packages complete policy-attestation -f values.yamlVerify the download
shasum -a 256 policy-attestation-1.0.0.utpkg should print the file SHA-256. How gallery packages are signed.
Versions
Installing a newer version upgrades in place: local credentials and requirement values are kept, and changes you made are flagged first. How packages work
More packages
Operations & Compliance
Monthly SOC 2 / ISO 27001 evidence run: automated controls are pulled from your systems, owners of manual controls are asked for a link, all logged for the auditor.
Needs:REST APIAssigneesEmail
Operations & Compliance
A daily check of your contract register: owners are reminded 60, 30 and 7 days before each notice deadline and asked to renew, renegotiate or terminate.
Needs:AssigneesEmail
Operations & Compliance
Handle access, erasure and other privacy requests: statutory deadline, identity check, search of CRM, billing and support, erasure, and a DPO-approved reply.
Needs:REST APIAssigneesEmail