PolicyPad: Executable AI Governance

• PolicyPad is a collection of policy-driven systems that treat policies as executable, optimizable, and auditable artifacts central to AI governance.
• It integrates methods like reinforcement learning for privacy delegation, LoRA modules for controlled refusal, and cryptographic receipts for compliance audits.
• These systems enable dynamic routing between local and remote LLMs, contextual privacy notices, and collaborative prototyping for enhanced policy design.

PolicyPad is a name used in recent AI and data-governance research for several policy-centered systems rather than for a single canonical architecture. In the cited literature, it denotes a learned policy for privacy-aware delegation between local and remote LLMs, a modular substrate for authorized relaxation of refusal behavior, a policy-governed and audit-ready RAG design, and an interactive environment for collaborative LLM-policy prototyping. Related work further positions PolicyPad as a host platform for privacy-policy modeling, contextual privacy notices, regulation-aware audits, contextual leakage detection, decoding-time personalization, and multi-framework compliance reasoning (Hui et al., 16 Oct 2025, Tan et al., 22 May 2026, Ray, 22 Oct 2025, Feng et al., 24 Sep 2025).

1. Terminological scope and principal usages

The recent literature does not present a single standardized definition of PolicyPad. Instead, the name is attached to distinct but partially compatible research programs that share a policy-first orientation: policies are treated as executable, optimizable, auditable, or collaboratively authorable artifacts rather than as static prose.

Usage of “PolicyPad”	Core function	Principal source
Learned privacy-aware delegation policy	Routes text chunks between a trusted local model and an untrusted remote model to optimize a privacy–utility trade-off	(Hui et al., 16 Oct 2025)
Authorized refusal-relaxation substrate	Selectively relaxes refusal behavior in authorized professional domains via composable modules	(Tan et al., 22 May 2026)
Policy-governed audit-ready RAG system	Enforces ex-ante gates, binds outputs to evidence, and emits portable cryptographic receipts	(Ray, 22 Oct 2025)
Collaborative prototyping environment	Supports synchronous drafting, scenario-grounded testing, and heuristic evaluation of LLM policies	(Feng et al., 24 Sep 2025)

Associated works extend or operationalize these usages through privacy-policy diagrams, contextual privacy notices, decoding-time preference control, regulation-aware privacy-policy corpora, contextual leakage guardrails, and RDF/SPARQL compliance reasoning (Majedi et al., 2024, Zhang et al., 16 Sep 2025, &&&10&&&, Musa et al., 2024, Zafar et al., 16 May 2026, Moreau et al., 5 Dec 2025). A recurring misconception is to treat all of these as one system lineage. The record instead shows a homonymous cluster of systems that converge on policy operationalization but differ in threat model, formalism, and deployment target.

2. Privacy-aware delegation as sequential decision-making

In "PrivacyPAD: A Reinforcement Learning Framework for Dynamic Privacy-Aware Delegation" (Hui et al., 16 Oct 2025), PolicyPad is the learned policy component at the heart of PrivacyPAD. The problem is posed as Privacy-Conscious Delegation: given a user query $q$ containing PII units $P = \{p_1,\ldots,p_k\}$, the system must produce a high-quality response while minimizing the PII disclosed to an untrusted remote LLM. Two models are available: $M_{\text{LOCAL}}$, described as trusted but weaker, and $M_{\text{REMOTE}}$, described as untrusted but stronger. Leakage is defined as the fraction of original PII units exposed to the remote model:

$$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$

The paper distinguishes replaceable PII from task-critical PII, but PolicyPad does not label these categories explicitly. Instead, it learns to differentiate them implicitly through reward optimization. This design is motivated by the failure mode of static masking and rewriting pipelines, which can shatter discourse coherence and remove information that is essential for correctness. The delegation problem is therefore cast as an episodic MDP $M=(S,A,P,R,\gamma)$ over sentence-level semantic chunks. The action space is binary, $a_t\in\{\text{local},\text{remote}\}$, and the episodic reward is

$$R=\mathrm{TaskGain}-\lambda\cdot (\mathrm{PrivacyLeak})^2,$$

where $\mathrm{TaskGain}\in\{0,1\}$ is assigned by an LLM-as-a-judge against a reference response $r^*$ from the unredacted remote model.

The policy architecture is a lightweight, stateful Transformer. Chunk embeddings are produced by frozen all-MiniLM-L6-v2; sinusoidal positional encodings are added; a 2-layer Transformer encoder contextualizes all chunks globally; and routing probabilities are parameterized by

$P = \{p_1,\ldots,p_k\}$0

Training proceeds in two stages. First, a conservative warm-up SFT stage uses heuristic labels that route any chunk containing PII locally. Second, PPO fine-tuning is performed with a clipped actor–critic objective, advantage normalization, a separate critic, and an entropy bonus. Sentence segmentation uses spaCy, hardware is 2× NVIDIA H200 GPUs, and inference concatenates chunk-level outputs before passing them through the local model for final synthesis.

Evaluation uses PUPA and the introduced Med-PCD dataset, which contains 1,020 medical instances with high PII density, average PII per instance of 4.6 versus 2.9 in PUPA, and a 816/204 train/test split. Quality validation on a 240-instance Med-PCD sample achieved 98.8% pass with Fleiss’ $P = \{p_1,\ldots,p_k\}$1. Utility is measured as Quality Preservation (%), and privacy as Leakage (%). On PUPA with Llama-3.1-8B as $P = \{p_1,\ldots,p_k\}$2, PAPILLON achieved 85.5% quality and 7.5% leakage, whereas PolicyPad achieved 86.1% and 4.5%. On Med-PCD with Llama-3.1-8B, PAPILLON achieved 82.0% and 9.2%, whereas PolicyPad achieved 89.5% and 5.1%. On Med-PCD with the weaker Llama-3.2-1B local model, PAPILLON achieved 45.1% and 42.5%, whereas PolicyPad achieved 75.3% and 18.2%. The largest gains occur when the local model is weak and the dataset is PII-dense.

The ablation results clarify the mechanism. On Med-PCD with Qwen2-7B, a stateless MLP router reached 75.2% quality and 11.5% leakage, while the stateful Transformer reached 88.4% and 12.0%, indicating that global context improves utility even when leakage remains similar. Replacing the quadratic penalty with a linear penalty left averages similar but increased catastrophic leaks, defined as cases with more than 80% P leaked, from 1.1% to 16.2%. Varying $P = \{p_1,\ldots,p_k\}$3 from 1.0 to 20 monotonically reduced leakage from 15.5% to 1.2% while lowering quality from 90.1% to 79.2%. The system’s stated limitations include single-turn scope, a binary action space, dependence on PII lists and an LLM judge, sensitivity to detector errors, and residual vulnerability under distribution shift and adversarial prompts.

3. Authorized safety-alignment relaxation and modular refusal control

In "Palette: A Modular, Controllable, and Efficient Framework for On-demand Authorized Safety Alignment Relaxation in LLMs" (Tan et al., 22 May 2026), PolicyPad denotes a system that grants on-demand, authorized relaxation of refusal policies in professional domains. Palette supplies the technical substrate. The basic motivation is that current aligned models implement a one-size-fits-all refusal policy, which can obstruct legitimate professional work in domains such as cybersecurity, chemical safety, and biosecurity diagnostics.

The paper formalizes the instruction space $P = \{p_1,\ldots,p_k\}$4 as a partition into a safe set $P = \{p_1,\ldots,p_k\}$5, an authorized set $P = \{p_1,\ldots,p_k\}$6, and a disallowed set $P = \{p_1,\ldots,p_k\}$7:

• $P = \{p_1,\ldots,p_k\}$8
• $P = \{p_1,\ldots,p_k\}$9
• $M_{\text{LOCAL}}$0

Here $M_{\text{LOCAL}}$1 is the base model’s general safety policy and $M_{\text{LOCAL}}$2 is the authorized rule set for a given user. The ideal decision function satisfies $M_{\text{LOCAL}}$3 on $M_{\text{LOCAL}}$4 and $M_{\text{LOCAL}}$5 on $M_{\text{LOCAL}}$6. Palette operationalizes this by extracting candidate refusal directions in representation space from contrastive harmful and harmless datasets, then selecting a Pareto-optimal direction using a multi-objective search that maximizes authorized-domain bypass while minimizing benign-domain drift. The control objective is

$M_{\text{LOCAL}}$7

and the utility objective is

$M_{\text{LOCAL}}$8

To remove inference-time steering overhead, the selected refusal direction is internalized via single-block LoRA adaptation. The adaptation objective reconstructs the steered activation for allowed prompts and the original activation elsewhere:

$M_{\text{LOCAL}}$9

Each authorized domain yields a module $M_{\text{REMOTE}}$0. Runtime composition is additive:

$M_{\text{REMOTE}}$1

with $M_{\text{REMOTE}}$2 serving as binary or continuous authorization gates. PolicyPad operationalizes authorization via signed capability keys, prompt-level gating, caching of merged weights per capability profile, and audit logging.

The reported training setup uses LoRA rank 8, scaling factor 16, batch size 8, 300 epochs, $M_{\text{REMOTE}}$3, and $M_{\text{REMOTE}}$4 for LLMs and 1.5 for VLMs. Only 20% of benchmark data is used for training, with balanced splits across $M_{\text{REMOTE}}$5, $M_{\text{REMOTE}}$6, and $M_{\text{REMOTE}}$7. On single RTX 4090 hardware, safety adaptation takes 69 s for LLaMA2-7B and 78 s for LLaMA3.1-8B; direction generation and selection take 5.3 s and 162 s for LLaMA2-7B, and 6.2 s and 186 s for LLaMA3.1-8B. The paper emphasizes that inference incurs zero additional arithmetic because merged weights are standard parameters.

Empirically, the system is evaluated on GenHarm, WMDP, CoSApien, and MM-SafetyBench. On GenHarm with LLaMA3.1-8B-Instruct and authorized Hate, allowed-domain refusal drops to 0.103 while Violence, Sexual, and Illegal refusal remain 0.976, 0.947, and 0.944; MMLU/GSM8K remain near base at 0.639/0.756 versus 0.636/0.759. On WMDP with LLaMA3.1-8B-Instruct, authorizing Chem yields Chem refusal 0.072 while Bio is 0.752, Cyber 0.987, General harmful 0.977, and utility average is 0.692 versus base 0.698. Multi-domain merging is also reported: for LLaMA2-7B-Chat on GenHarm, Hate+Disinfo merging yields 0.066 and 0.122 refusal in the two authorized domains while non-target refusal remains close to base. The paper states that minor leakage can occur for semantically overlapping domains, mitigated by hard disallowed sample mining. Authorization is assumed rather than solved, and strong identity verification, least privilege, revocation, and oversight are explicitly treated as necessary complements.

4. Policy-governed RAG, cryptographic receipts, and compliance enforcement

In "Policy-Governed RAG - Research Design Study" (Ray, 22 Oct 2025), PolicyPad is a policy-governed, audit-ready RAG system organized as a triptych: Contracts/Control (SHRDLU-like), Manifests/Trails (Memex-like), and Receipts/Verification (Xanadu-like). The design is explicitly ex-ante: policy gates generation before emission, binds each material answer to verifiable evidence, and emits a portable COSE/JOSE Answer Receipt suitable for offline audit. The main execution path is user query → retrieval → scope gate → verifier cascade → multiplicity adjustment → independence/caps → MSES reduction → proof assembly → signing/KRN checks → PROMOTE_FULL or PROMOTE_LITE, else ABSTAIN.

The control layer enforces typed thresholds, caps, and rule sets pinned by SHA-256 policy snapshots. The gate function $M_{\text{REMOTE}}$8 passes only if scope, support, contradiction, multiplicity, independence, privacy, and proof checks all pass. The design specifies grounding rules such as at least two independent supports, no contradictions, a justification score threshold, selective prediction for abstention, issuer share $M_{\text{REMOTE}}$9, graph independence $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$0 with $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$1, and temporal diversity on drifting topics. Proof SLOs are proof_size_p90 < 64 KB, proof_size_p99 < 256 KB, and proof_verify_p95 $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$2 ms; proof timeout defaults to 300 ms. Example NO-GO gates for confirmatory evaluation specify at least 20% relative reduction in confident-error@t, helpful-abstain at least 70%, abandonment no more than +10% versus control, latency p95 $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$3 ms, cost ratio $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$4 P50, and a dependence floor of $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$5 with 95% CI lower bound $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$6.

A separate privacy-enforcement line is provided by "Privacy Policy Enforcement Guardrails for Data-Sensitive Retrieval-Augmented Generation" (Zafar et al., 16 May 2026). This work argues that standard PII filters miss contextual leakage due to quasi-identifier clusters. The proposed PPE framework uses fused 3,072-dimensional embeddings from Qwen3-Embedding-0.6B, BGE-M3, and E5-large-v2, plus dual one-class density estimators. In the recommended T3+OCSVM-v4 configuration, the discriminator is

$$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$7

with abstention when both scores fall below calibrated thresholds $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$8 and $$\mathrm{Leakage}(Q'_{\mathrm{remote}}, P)=\frac{1}{|P|}\sum_{i=1}^{k}\mathbf{1}[p_i\in Q'_{\mathrm{remote}}].$$9. The paper reports borderline AUROC of 0.965 in medicine, 0.963 in finance, and 0.930 in law, together with 44–55 percentage-point reductions in borderline FPR95 relative to the T3+GMM-v3 baseline, and approximately 5 ms per-sample inference latency. This makes PPE suitable as an inline Layer-2 guardrail within a PolicyPad-style RAG stack.

Multi-framework compliance reasoning is supplied by "Parajudica: An RDF-Based Reasoner and Metamodel for Multi-Framework Context-Dependent Data Compliance Assessments" (Moreau et al., 5 Dec 2025). Here PolicyPad is equipped with an RDF knowledge graph, modular framework packages, SPARQL CONSTRUCT rules, and least-fixed-point evaluation. Compliance assertions are scope- and framework-specific, and the system computes closure by iterating

$M=(S,A,P,R,\gamma)$0

until the least fixed point $M=(S,A,P,R,\gamma)$1 is reached. The compliance status function is defined as $M=(S,A,P,R,\gamma)$2, while the PBAC decision function is

$M=(S,A,P,R,\gamma)$3

The paper emphasizes that frameworks should remain parallel rather than forcibly unified; PolicyPad is expected to adopt intersection, union, or weighted aggregation depending on governance policy. This architecture aligns naturally with the receipt-backed RAG design: both treat governance as an executable layer with explicit evidence, thresholds, and replayable reasoning.

5. Privacy-policy representation, contextual notice, and regulation-aware auditing

A distinct strand treats PolicyPad as a platform for authoring, explaining, and auditing privacy policies. In "The Privacy Policy Permission Model: A Unified View of Privacy Policies" (Majedi et al., 2024), PolicyPad can use PPPM as its core authoring and validation scaffold. PPPM models policies through roles $M=(S,A,P,R,\gamma)$4, purposes $M=(S,A,P,R,\gamma)$5, tasks $M=(S,A,P,R,\gamma)$6, data attributes $M=(S,A,P,R,\gamma)$7, attribute groups $M=(S,A,P,R,\gamma)$8, conditions $M=(S,A,P,R,\gamma)$9, role hierarchies $a_t\in\{\text{local},\text{remote}\}$0, role-purpose permissions $a_t\in\{\text{local},\text{remote}\}$1, purpose-task permissions $a_t\in\{\text{local},\text{remote}\}$2, and aggregations $a_t\in\{\text{local},\text{remote}\}$3. A central operational rule is

$a_t\in\{\text{local},\text{remote}\}$4

This produces a Privacy Policy Permission Diagram (PPPD) that can reveal orphaned permissions, unjustified group access, conflicting conditions, unauthorized disclosure, inheritance gaps, and purpose-limitation failures. The paper’s ChatterBaby case is used to illustrate how an all-encompassing “Any” purpose and passive-voice omissions become visible as severe risks once represented diagrammatically.

The user-facing contextualization counterpart is "Conflect: Designing Reflective Thinking-Based Contextual Privacy Policy for Mobile Applications" (Zhang et al., 16 Sep 2025). Conflect is proposed as a design pattern for PolicyPad-style contextual privacy notices. It adopts the Experience–Reflection–Action framework, identifies the disconnect between context and action as the highest-priority design problem, and implements sidebar alerts with layered disclosure. The technical pipeline uses screenshots as input, PaddleOCR for text, a pretrained ResNet for icons, GPT-4o for policy retrieval and segmentation, and GPT-4o again to synthesize a concise data-practice notice and a contextualized risk scenario. Reported technical performance includes 94.0% policy extraction accuracy on CPP4APP, average end-to-end latency of 4.35 s with standard deviation 0.93, policy finding accuracy of 100.0% on CPP4APP, 99.2% on CA4P-483, and 96.9% on MAPP Corpus, plus average usefulness of generated risks of 6.4/7 on CPP4APP. A user study with $a_t\in\{\text{local},\text{remote}\}$5 reported significant improvements over comparison conditions on understanding, usability, and multiple UEQ-S and NASA-TLX dimensions; the abstract summarizes this as improved understanding, trust, and satisfaction together with lower cognitive load.

Regulation-aware auditing is enabled by "C3PA: An Open Dataset of Expert-Annotated and Regulation-Aware Privacy Policies to Enable Scalable Regulatory Compliance Audits" (Musa et al., 2024). C3PA contains 48,947 annotated segments from 411 unique organizations and maps text spans to 12 CCPA/CPRA-responsive labels, including updated privacy policy, categories collected, categories sold, opt-out rights, and methods to exercise rights. Each policy was annotated by exactly three law-student annotators over a 14-week cycle; combined span-level F1 rose from 0.46 in Week 1 to 0.70 in Week 8, and combined Cohen’s Kappa rose from 0.55 to 0.85. A DistilBERT baseline trained on C3PA yields macro-F1 of approximately 0.67, close to final annotator span-level agreement, and is about 7% better than an OPP-115-based model on the shared L4 label. For a PolicyPad-style audit stack, this provides a regulation-aware substrate for segment-level detection, policy-level checklisting, and human-in-the-loop escalation on hard labels such as L2, L3, and L8.

Taken together, these works show a progression from formal policy modeling, to contextual end-user presentation, to regulation-specific extraction and auditing. This suggests a broader PolicyPad interpretation in which privacy policies are simultaneously machine-readable, interactive, and auditable, rather than merely displayed as long-form legal prose.

6. Collaborative policy prototyping, decoding-time control, and broader significance

In "PolicyPad: Collaborative Prototyping of LLM Policies" (Feng et al., 24 Sep 2025), PolicyPad is an interactive environment for small-group, synchronous policy design. The system was motivated by a 15-week contextual inquiry involving 19 workshops with 9 experts, which identified limited participatory input, incomplete feedback loops, and lack of prototyping-native tooling as recurring problems in LLM policy design. The implemented system couples a shared TipTap-based editor with scenario widgets, spotlights, private scenario testing, automated heuristic evaluation, and policy versioning. Policy snapshots trigger three actions: saving a new version, running automated heuristic evaluation with o4-mini, and regenerating the latest AI response across all scenarios. The policy-informed model is Llama 3.3 70B Instruct Turbo hosted on Together.ai; GPT-4o is used for titles and notes; o4-mini supports heuristic evaluation and policy-suggestion generation from collaboratively edited responses.

The scenario representation is explicitly structured as a triple $a_t\in\{\text{local},\text{remote}\}$6. In the evaluation, eight groups of 22 domain experts, spanning mental health and law, compared PolicyPad with a baseline editor-plus-sidebar condition. The primary quantitative difference was novelty of policy statements: PolicyPad produced 51.9% novel statements versus 18.2% for the baseline, corresponding to raw counts of 40 versus 10. Cross-rated policy quality did not differ significantly: for “important considerations,” $a_t\in\{\text{local},\text{remote}\}$7, $a_t\in\{\text{local},\text{remote}\}$8, and $a_t\in\{\text{local},\text{remote}\}$9; for “agreement,” $$R=\mathrm{TaskGain}-\lambda\cdot (\mathrm{PrivacyLeak})^2,$$0, $$R=\mathrm{TaskGain}-\lambda\cdot (\mathrm{PrivacyLeak})^2,$$1, and $$R=\mathrm{TaskGain}-\lambda\cdot (\mathrm{PrivacyLeak})^2,$$2. Qualitative analysis attributes the novelty gain to scenario spotlights, rapid regenerate-and-continue loops, visible heuristics, and the ability to turn edited responses into proposed policy statements; every such suggestion reported in the study was accepted.

A technically separate but conceptually adjacent line appears in "PAD: Personalized Alignment of LLMs at Decoding-Time" (Chen et al., 2024), where PolicyPad is described as a plug-in system that applies user or organizational policies at decoding time without retraining the base model. The core reward factorization is

$$R=\mathrm{TaskGain}-\lambda\cdot (\mathrm{PrivacyLeak})^2,$$3

and PAD-guided decoding uses

$$R=\mathrm{TaskGain}-\lambda\cdot (\mathrm{PrivacyLeak})^2,$$4

This line treats policies as runtime preference vectors or descriptors that can be composed, reweighted, and enforced token by token. Reported results show strong alignment gains: on P-Soups, overall reward-model average improves from 0.32 for the base model to 1.06 for PAD, with GPT-4 overall win rate reaching 84%; on HelpSteer2, overall reward-model average improves from 0.17 to 0.96, with win rate reaching 80%. The paper also reports relative runtime costs on a single NVIDIA H100: Base 120, Greedy PAD approximately 256, Stochastic PAD approximately 358, and Best-of-k PAD approximately 1250.

Across these distinct usages, a common pattern emerges: PolicyPad denotes a shift from static policy text toward executable policy artifacts. In some systems the artifact is a routing policy learned by PPO; in others it is a composable LoRA module, a cryptographically receipted gate, a PPPM diagram, a regulation-aware audit classifier, a collaborative draft linked to scenarios, or a decoding-time reward controller. This suggests a family resemblance rather than a unified software stack. The literature also converges on recurrent limitations: authorization is often assumed rather than fully solved, detector or judge errors can bias evaluation, OOD inputs remain a persistent failure mode, some systems remain single-turn or prompt-level only, and formal guarantees are typically weaker than the operational controls they expose.