From 312474354ca800b6d63b2952596129819a8ea5e5 Mon Sep 17 00:00:00 2001
From: gearnode <bryan@frimin.fr>
Date: Tue, 4 Mar 2025 12:09:22 +0100
Subject: [PATCH] Add policies

Signed-off-by: gearnode <bryan@frimin.fr>
---
 apps/console/src/App.tsx                      |   52 +-
 apps/console/src/components/AppSidebar.tsx    |    8 +
 apps/console/src/layouts/ConsoleLayout.tsx    |  125 +-
 ...utBreadcrumbPolicyOverviewQuery.graphql.ts |  127 ++
 ...youtBreadcrumbUpdatePolicyQuery.graphql.ts |  127 ++
 .../console/src/pages/ControlOverviewPage.tsx |   24 +-
 apps/console/src/pages/CreatePolicyPage.tsx   |  194 ++
 apps/console/src/pages/PolicyListPage.tsx     |  179 ++
 apps/console/src/pages/PolicyOverviewPage.tsx |  230 +++
 apps/console/src/pages/UpdatePolicyPage.tsx   |  270 +++
 .../CreatePolicyPageMutation.graphql.ts       |  186 ++
 .../PolicyListPageQuery.graphql.ts            |  269 +++
 .../PolicyOverviewPageQuery.graphql.ts        |  160 ++
 .../UpdatePolicyPageMutation.graphql.ts       |  134 ++
 .../UpdatePolicyPageQuery.graphql.ts          |  152 ++
 package-lock.json                             |   79 +-
 pkg/api/console/v1/schema.graphql             |   73 +
 pkg/api/console/v1/schema/schema.go           | 1833 +++++++++++++++++
 pkg/api/console/v1/types/policy.go            |   51 +
 pkg/api/console/v1/types/types.go             |   55 +
 pkg/api/console/v1/v1_resolver.go             |   65 +
 pkg/probo/coredata/entity_type_reg.go         |    1 +
 .../coredata/migrations/20250228T000000Z.sql  |   12 +
 pkg/probo/coredata/policy.go                  |  250 +++
 pkg/probo/coredata/policy_status.go           |   74 +
 pkg/probo/policy_service.go                   |  162 ++
 pkg/probo/{probo.go => service.go}            |   17 +-
 27 files changed, 4882 insertions(+), 27 deletions(-)
 create mode 100644 apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbPolicyOverviewQuery.graphql.ts
 create mode 100644 apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbUpdatePolicyQuery.graphql.ts
 create mode 100644 apps/console/src/pages/CreatePolicyPage.tsx
 create mode 100644 apps/console/src/pages/PolicyListPage.tsx
 create mode 100644 apps/console/src/pages/PolicyOverviewPage.tsx
 create mode 100644 apps/console/src/pages/UpdatePolicyPage.tsx
 create mode 100644 apps/console/src/pages/__generated__/CreatePolicyPageMutation.graphql.ts
 create mode 100644 apps/console/src/pages/__generated__/PolicyListPageQuery.graphql.ts
 create mode 100644 apps/console/src/pages/__generated__/PolicyOverviewPageQuery.graphql.ts
 create mode 100644 apps/console/src/pages/__generated__/UpdatePolicyPageMutation.graphql.ts
 create mode 100644 apps/console/src/pages/__generated__/UpdatePolicyPageQuery.graphql.ts
 create mode 100644 pkg/api/console/v1/types/policy.go
 create mode 100644 pkg/probo/coredata/migrations/20250228T000000Z.sql
 create mode 100644 pkg/probo/coredata/policy.go
 create mode 100644 pkg/probo/coredata/policy_status.go
 create mode 100644 pkg/probo/policy_service.go
 rename pkg/probo/{probo.go => service.go} (86%)

diff --git a/apps/console/src/App.tsx b/apps/console/src/App.tsx
index 6e76d8cf6..eafe1f673 100644
--- a/apps/console/src/App.tsx
+++ b/apps/console/src/App.tsx
@@ -24,7 +24,7 @@ posthog.init(process.env.POSTHOG_KEY!, {
 });
 
 const OrganizationSelectionPage = lazy(
-  () => import("./pages/OrganizationSelectionPage"),
+  () => import("./pages/OrganizationSelectionPage")
 );
 const HomePage = lazy(() => import("./pages/HomePage"));
 const NotFoundPage = lazy(() => import("./pages/NotFoundPage"));
@@ -35,19 +35,24 @@ const VendorOverviewPage = lazy(() => import("./pages/VendorOverviewPage"));
 const SettingsPage = lazy(() => import("./pages/SettingsPage"));
 const CreatePeoplePage = lazy(() => import("./pages/CreatePeoplePage"));
 const FrameworkOverviewPage = lazy(
-  () => import("./pages/FrameworkOverviewPage"),
+  () => import("./pages/FrameworkOverviewPage")
 );
 const ControlOverviewPage = lazy(() => import("./pages/ControlOverviewPage"));
 const PeopleOverviewPage = lazy(() => import("./pages/PeopleOverviewPage"));
 const LoginPage = lazy(() => import("./pages/LoginPage"));
 const RegisterPage = lazy(() => import("./pages/RegisterPage"));
 const CreateOrganizationPage = lazy(
-  () => import("./pages/CreateOrganizationPage"),
+  () => import("./pages/CreateOrganizationPage")
 );
 const CreateFrameworkPage = lazy(() => import("./pages/CreateFrameworkPage"));
 const CreateControlPage = lazy(() => import("./pages/CreateControlPage"));
 const UpdateFrameworkPage = lazy(() => import("./pages/UpdateFrameworkPage"));
 const UpdateControlPage = lazy(() => import("./pages/UpdateControlPage"));
+// Policy pages
+const PolicyListPage = lazy(() => import("./pages/PolicyListPage"));
+const PolicyOverviewPage = lazy(() => import("./pages/PolicyOverviewPage"));
+const CreatePolicyPage = lazy(() => import("./pages/CreatePolicyPage"));
+const UpdatePolicyPage = lazy(() => import("./pages/UpdatePolicyPage"));
 
 function App() {
   return (
@@ -282,6 +287,47 @@ function App() {
                             </Suspense>
                           }
                         />
+                        {/* Policy Routes */}
+                        <Route
+                          path="policies"
+                          element={
+                            <Suspense>
+                              <ErrorBoundaryWithLocation>
+                                <PolicyListPage />
+                              </ErrorBoundaryWithLocation>
+                            </Suspense>
+                          }
+                        />
+                        <Route
+                          path="policies/create"
+                          element={
+                            <Suspense>
+                              <ErrorBoundaryWithLocation>
+                                <CreatePolicyPage />
+                              </ErrorBoundaryWithLocation>
+                            </Suspense>
+                          }
+                        />
+                        <Route
+                          path="policies/:policyId"
+                          element={
+                            <Suspense>
+                              <ErrorBoundaryWithLocation>
+                                <PolicyOverviewPage />
+                              </ErrorBoundaryWithLocation>
+                            </Suspense>
+                          }
+                        />
+                        <Route
+                          path="policies/:policyId/update"
+                          element={
+                            <Suspense>
+                              <ErrorBoundaryWithLocation>
+                                <UpdatePolicyPage />
+                              </ErrorBoundaryWithLocation>
+                            </Suspense>
+                          }
+                        />
                         <Route
                           path="settings"
                           element={
diff --git a/apps/console/src/components/AppSidebar.tsx b/apps/console/src/components/AppSidebar.tsx
index 971a1ba92..36cee0c3a 100644
--- a/apps/console/src/components/AppSidebar.tsx
+++ b/apps/console/src/components/AppSidebar.tsx
@@ -9,6 +9,7 @@ import {
   Send,
   Settings,
   Building,
+  FileText,
 } from "lucide-react";
 import {
   graphql,
@@ -64,6 +65,13 @@ function getNavItems(organizationId?: string) {
             ]
           : [],
       },
+      {
+        title: "Policies",
+        url: organizationId
+          ? `/organizations/${organizationId}/policies`
+          : undefined,
+        icon: FileText,
+      },
       {
         title: "Settings",
         url: organizationId
diff --git a/apps/console/src/layouts/ConsoleLayout.tsx b/apps/console/src/layouts/ConsoleLayout.tsx
index d4aed7981..e0fb91ddb 100644
--- a/apps/console/src/layouts/ConsoleLayout.tsx
+++ b/apps/console/src/layouts/ConsoleLayout.tsx
@@ -24,6 +24,8 @@ import { ConsoleLayoutBreadcrumbControlOverviewQuery } from "./__generated__/Con
 import { ConsoleLayoutOrganizationQuery } from "./__generated__/ConsoleLayoutOrganizationQuery.graphql";
 import { ConsoleLayoutBreadcrumbCreateControlQuery } from "./__generated__/ConsoleLayoutBreadcrumbCreateControlQuery.graphql";
 import { ConsoleLayoutBreadcrumbUpdateFrameworkQuery } from "./__generated__/ConsoleLayoutBreadcrumbUpdateFrameworkQuery.graphql";
+import { ConsoleLayoutBreadcrumbPolicyOverviewQuery } from "./__generated__/ConsoleLayoutBreadcrumbPolicyOverviewQuery.graphql";
+import { ConsoleLayoutBreadcrumbUpdatePolicyQuery } from "./__generated__/ConsoleLayoutBreadcrumbUpdatePolicyQuery.graphql";
 
 function BreadcrumbHome({ children }: { children: React.ReactNode }) {
   const { organizationId } = useParams();
@@ -58,7 +60,7 @@ function BreadcrumbHome({ children }: { children: React.ReactNode }) {
       }
     `,
     { organizationId: organizationId! },
-    { fetchPolicy: "store-or-network" },
+    { fetchPolicy: "store-or-network" }
   );
 
   return (
@@ -118,7 +120,7 @@ function BreadcrumbFrameworkOverview() {
         }
       }
     `,
-    { frameworkId: frameworkId! },
+    { frameworkId: frameworkId! }
   );
 
   return (
@@ -152,7 +154,7 @@ function BreadcrumbUpdateFramework() {
       }
     `,
     { frameworkId: frameworkId! },
-    { fetchPolicy: "store-or-network" },
+    { fetchPolicy: "store-or-network" }
   );
 
   return (
@@ -209,7 +211,7 @@ function BreadcrumbVendorOverview() {
       }
     `,
     { vendorId: vendorId! },
-    { fetchPolicy: "store-or-network" },
+    { fetchPolicy: "store-or-network" }
   );
 
   return (
@@ -269,7 +271,7 @@ function BreadcrumbPeopleOverview() {
       }
     `,
     { peopleId: peopleId! },
-    { fetchPolicy: "store-or-network" },
+    { fetchPolicy: "store-or-network" }
   );
 
   return (
@@ -302,7 +304,7 @@ function BreadcrumbControlOverview() {
         }
       }
     `,
-    { controlId: controlId! },
+    { controlId: controlId! }
   );
 
   return (
@@ -333,7 +335,7 @@ function BreadcrumbCreateControl() {
         }
       }
     `,
-    { frameworkId: frameworkId! },
+    { frameworkId: frameworkId! }
   );
 
   return (
@@ -356,6 +358,104 @@ function BreadcrumbCreateControl() {
   );
 }
 
+function BreadcrumbPolicyList() {
+  const { organizationId } = useParams();
+  return (
+    <>
+      <BreadcrumbSeparator />
+      <BreadcrumbItem>
+        <BreadcrumbLink asChild>
+          <Link to={`/organizations/${organizationId}/policies`}>Policies</Link>
+        </BreadcrumbLink>
+      </BreadcrumbItem>
+      <Outlet />
+    </>
+  );
+}
+
+function BreadcrumbCreatePolicy() {
+  return (
+    <>
+      <BreadcrumbSeparator />
+      <BreadcrumbItem>
+        <BreadcrumbPage>Create Policy</BreadcrumbPage>
+      </BreadcrumbItem>
+    </>
+  );
+}
+
+function BreadcrumbPolicyOverview() {
+  const { organizationId, policyId } = useParams();
+  const data = useLazyLoadQuery<ConsoleLayoutBreadcrumbPolicyOverviewQuery>(
+    graphql`
+      query ConsoleLayoutBreadcrumbPolicyOverviewQuery($policyId: ID!) {
+        policy: node(id: $policyId) {
+          id
+          ... on Policy {
+            name
+          }
+        }
+      }
+    `,
+    { policyId: policyId! },
+    { fetchPolicy: "store-or-network" }
+  );
+
+  return (
+    <>
+      <BreadcrumbSeparator />
+      <BreadcrumbItem>
+        <BreadcrumbLink asChild>
+          <Link to={`/organizations/${organizationId}/policies/${policyId}`}>
+            {data.policy?.name}
+          </Link>
+        </BreadcrumbLink>
+      </BreadcrumbItem>
+      <Outlet />
+    </>
+  );
+}
+
+function BreadcrumbUpdatePolicy() {
+  const { organizationId, policyId } = useParams();
+  const data = useLazyLoadQuery<ConsoleLayoutBreadcrumbUpdatePolicyQuery>(
+    graphql`
+      query ConsoleLayoutBreadcrumbUpdatePolicyQuery($policyId: ID!) {
+        policy: node(id: $policyId) {
+          id
+          ... on Policy {
+            name
+          }
+        }
+      }
+    `,
+    { policyId: policyId! },
+    { fetchPolicy: "store-or-network" }
+  );
+
+  return (
+    <>
+      <BreadcrumbSeparator />
+      <BreadcrumbItem>
+        <BreadcrumbLink
+          asChild
+          className="max-w-[160px] truncate"
+          aria-label={data.policy?.name}
+        >
+          <Link to={`/organizations/${organizationId}/policies/${policyId}`}>
+            {data.policy?.name}
+          </Link>
+        </BreadcrumbLink>
+      </BreadcrumbItem>
+      <BreadcrumbSeparator />
+      <BreadcrumbItem>
+        <BreadcrumbPage>Update</BreadcrumbPage>
+      </BreadcrumbItem>
+      <Outlet />
+    </>
+  );
+}
+
 export default function ConsoleLayout() {
   const { organizationId } = useParams();
   const showBreadcrumb = !!organizationId;
@@ -410,6 +510,17 @@ export default function ConsoleLayout() {
                       element={<BreadcrumbVendorOverview />}
                     />
                   </Route>
+                  <Route path="policies" element={<BreadcrumbPolicyList />}>
+                    <Route
+                      path=":policyId"
+                      element={<BreadcrumbPolicyOverview />}
+                    />
+                    <Route
+                      path=":policyId/update"
+                      element={<BreadcrumbUpdatePolicy />}
+                    />
+                    <Route path="create" element={<BreadcrumbCreatePolicy />} />
+                  </Route>
                 </Routes>
               )}
             </BreadcrumbHome>
diff --git a/apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbPolicyOverviewQuery.graphql.ts b/apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbPolicyOverviewQuery.graphql.ts
new file mode 100644
index 000000000..2412c717a
--- /dev/null
+++ b/apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbPolicyOverviewQuery.graphql.ts
@@ -0,0 +1,127 @@
+/**
+ * @generated SignedSource<<03812f2d66d34ef3636bc7890059f4cf>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type ConsoleLayoutBreadcrumbPolicyOverviewQuery$variables = {
+  policyId: string;
+};
+export type ConsoleLayoutBreadcrumbPolicyOverviewQuery$data = {
+  readonly policy: {
+    readonly id: string;
+    readonly name?: string;
+  };
+};
+export type ConsoleLayoutBreadcrumbPolicyOverviewQuery = {
+  response: ConsoleLayoutBreadcrumbPolicyOverviewQuery$data;
+  variables: ConsoleLayoutBreadcrumbPolicyOverviewQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "policyId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "policyId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "name",
+      "storageKey": null
+    }
+  ],
+  "type": "Policy",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "ConsoleLayoutBreadcrumbPolicyOverviewQuery",
+    "selections": [
+      {
+        "alias": "policy",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "ConsoleLayoutBreadcrumbPolicyOverviewQuery",
+    "selections": [
+      {
+        "alias": "policy",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "2c38760f04efaf9b41d6b2abb17c2074",
+    "id": null,
+    "metadata": {},
+    "name": "ConsoleLayoutBreadcrumbPolicyOverviewQuery",
+    "operationKind": "query",
+    "text": "query ConsoleLayoutBreadcrumbPolicyOverviewQuery(\n  $policyId: ID!\n) {\n  policy: node(id: $policyId) {\n    __typename\n    id\n    ... on Policy {\n      name\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "f2a356a6aa9b98ca13dde3b82e2e868a";
+
+export default node;
diff --git a/apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbUpdatePolicyQuery.graphql.ts b/apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbUpdatePolicyQuery.graphql.ts
new file mode 100644
index 000000000..c3ad0009a
--- /dev/null
+++ b/apps/console/src/layouts/__generated__/ConsoleLayoutBreadcrumbUpdatePolicyQuery.graphql.ts
@@ -0,0 +1,127 @@
+/**
+ * @generated SignedSource<<7fd05943b12b7927bddcb4ee8a1cdd76>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type ConsoleLayoutBreadcrumbUpdatePolicyQuery$variables = {
+  policyId: string;
+};
+export type ConsoleLayoutBreadcrumbUpdatePolicyQuery$data = {
+  readonly policy: {
+    readonly id: string;
+    readonly name?: string;
+  };
+};
+export type ConsoleLayoutBreadcrumbUpdatePolicyQuery = {
+  response: ConsoleLayoutBreadcrumbUpdatePolicyQuery$data;
+  variables: ConsoleLayoutBreadcrumbUpdatePolicyQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "policyId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "policyId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "name",
+      "storageKey": null
+    }
+  ],
+  "type": "Policy",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "ConsoleLayoutBreadcrumbUpdatePolicyQuery",
+    "selections": [
+      {
+        "alias": "policy",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "ConsoleLayoutBreadcrumbUpdatePolicyQuery",
+    "selections": [
+      {
+        "alias": "policy",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "6b895165c1104f2caf67bf4ded9a795d",
+    "id": null,
+    "metadata": {},
+    "name": "ConsoleLayoutBreadcrumbUpdatePolicyQuery",
+    "operationKind": "query",
+    "text": "query ConsoleLayoutBreadcrumbUpdatePolicyQuery(\n  $policyId: ID!\n) {\n  policy: node(id: $policyId) {\n    __typename\n    id\n    ... on Policy {\n      name\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "ee8e83ba02f1545ad73fe5d9742136ff";
+
+export default node;
diff --git a/apps/console/src/pages/ControlOverviewPage.tsx b/apps/console/src/pages/ControlOverviewPage.tsx
index 8c78a55bf..1cf978ea0 100644
--- a/apps/console/src/pages/ControlOverviewPage.tsx
+++ b/apps/console/src/pages/ControlOverviewPage.tsx
@@ -186,7 +186,7 @@ function ControlOverviewPageContent({
 }) {
   const data = usePreloadedQuery<ControlOverviewPageQueryType>(
     controlOverviewPageQuery,
-    queryRef,
+    queryRef
   );
   const { toast } = useToast();
   const { organizationId, frameworkId, controlId } = useParams();
@@ -194,7 +194,7 @@ function ControlOverviewPageContent({
   const environment = useRelayEnvironment();
   const [updateTaskState] =
     useMutation<ControlOverviewPageUpdateTaskStateMutationType>(
-      updateTaskStateMutation,
+      updateTaskStateMutation
     );
   const [createTask] =
     useMutation<ControlOverviewPageCreateTaskMutationType>(createTaskMutation);
@@ -202,11 +202,11 @@ function ControlOverviewPageContent({
     useMutation<ControlOverviewPageDeleteTaskMutationType>(deleteTaskMutation);
   const [uploadEvidence] =
     useMutation<ControlOverviewPageUploadEvidenceMutationType>(
-      uploadEvidenceMutation,
+      uploadEvidenceMutation
     );
   const [deleteEvidence] =
     useMutation<ControlOverviewPageDeleteEvidenceMutationType>(
-      deleteEvidenceMutation,
+      deleteEvidenceMutation
     );
 
   const [isCreateTaskOpen, setIsCreateTaskOpen] = useState(false);
@@ -228,7 +228,7 @@ function ControlOverviewPageContent({
   const fileInputRef = useRef<HTMLInputElement>(null);
 
   const [draggedOverTaskId, setDraggedOverTaskId] = useState<string | null>(
-    null,
+    null
   );
   const [uploadingTaskId, setUploadingTaskId] = useState<string | null>(null);
   const [isDraggingFile, setIsDraggingFile] = useState(false);
@@ -265,7 +265,7 @@ function ControlOverviewPageContent({
       }
       return null;
     },
-    [tasks],
+    [tasks]
   );
 
   useEffect(() => {
@@ -424,7 +424,7 @@ function ControlOverviewPageContent({
 
   const handleEditControl = () => {
     navigate(
-      `/organizations/${organizationId}/frameworks/${frameworkId}/controls/${controlId}/update`,
+      `/organizations/${organizationId}/frameworks/${frameworkId}/controls/${controlId}/update`
     );
   };
 
@@ -630,7 +630,7 @@ function ControlOverviewPageContent({
   const handleDeleteEvidence = (
     evidenceId: string,
     filename: string,
-    taskId: string,
+    taskId: string
   ) => {
     setEvidenceToDelete({ id: evidenceId, filename, taskId });
     setIsDeleteEvidenceOpen(true);
@@ -640,7 +640,7 @@ function ControlOverviewPageContent({
     if (!evidenceToDelete) return;
 
     const evidenceConnectionId = getEvidenceConnectionId(
-      evidenceToDelete.taskId,
+      evidenceToDelete.taskId
     );
 
     deleteEvidence({
@@ -998,10 +998,10 @@ function ControlOverviewPageContent({
                                     handleDeleteEvidence(
                                       evidence.id,
                                       evidence.filename,
-                                      task.id,
+                                      task.id
                                     );
                                   }}
-                                  className="p-1 rounded-full hover:bg-gray-100 hover:bg-red-50 hover:text-red-600"
+                                  className="p-1 rounded-full hover:bg-gray-10 hover:text-red-600"
                                   title="Delete Evidence"
                                 >
                                   <Trash2 className="w-4 h-4 text-gray-600 hover:text-red-600" />
@@ -1238,7 +1238,7 @@ function ControlOverviewPageFallback() {
 export default function ControlOverviewPage() {
   const { controlId } = useParams();
   const [queryRef, loadQuery] = useQueryLoader<ControlOverviewPageQueryType>(
-    controlOverviewPageQuery,
+    controlOverviewPageQuery
   );
 
   useEffect(() => {
diff --git a/apps/console/src/pages/CreatePolicyPage.tsx b/apps/console/src/pages/CreatePolicyPage.tsx
new file mode 100644
index 000000000..14ed93c8c
--- /dev/null
+++ b/apps/console/src/pages/CreatePolicyPage.tsx
@@ -0,0 +1,194 @@
+import { useState } from "react";
+import { useNavigate, useParams } from "react-router";
+import { ConnectionHandler, graphql, useMutation } from "react-relay";
+import { Helmet } from "react-helmet-async";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Textarea } from "@/components/ui/textarea";
+import { useToast } from "@/hooks/use-toast";
+import { FileText } from "lucide-react";
+import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group";
+import type { CreatePolicyPageMutation } from "./__generated__/CreatePolicyPageMutation.graphql";
+
+const CreatePolicyMutation = graphql`
+  mutation CreatePolicyPageMutation(
+    $input: CreatePolicyInput!
+    $connections: [ID!]!
+  ) {
+    createPolicy(input: $input) {
+      policyEdge @prependEdge(connections: $connections) {
+        node {
+          id
+          name
+          content
+          status
+        }
+      }
+    }
+  }
+`;
+
+export default function CreatePolicyPage() {
+  const navigate = useNavigate();
+  const { organizationId } = useParams();
+  const [name, setName] = useState("");
+  const [content, setContent] = useState("");
+  const [status, setStatus] = useState<"DRAFT" | "ACTIVE">("DRAFT");
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const { toast } = useToast();
+
+  const [commitMutation] =
+    useMutation<CreatePolicyPageMutation>(CreatePolicyMutation);
+
+  const handleSubmit = (e: React.FormEvent) => {
+    e.preventDefault();
+    setIsSubmitting(true);
+
+    const input = {
+      organizationId: organizationId!,
+      name,
+      content,
+      status,
+    };
+
+    commitMutation({
+      variables: {
+        input,
+        connections: [
+          ConnectionHandler.getConnectionID(
+            organizationId!,
+            "PolicyListPage_policies"
+          ),
+        ],
+      },
+      onCompleted: (response, errors) => {
+        setIsSubmitting(false);
+        if (errors) {
+          console.error("Error creating policy:", errors);
+          toast({
+            title: "Error",
+            description: "Failed to create policy. Please try again.",
+            variant: "destructive",
+          });
+          return;
+        }
+
+        toast({
+          title: "Success",
+          description: "Policy created successfully!",
+        });
+
+        navigate(
+          `/organizations/${organizationId}/policies/${response.createPolicy.policyEdge.node.id}`
+        );
+      },
+      onError: (error) => {
+        setIsSubmitting(false);
+        console.error("Error creating policy:", error);
+        toast({
+          title: "Error",
+          description: "Failed to create policy. Please try again.",
+          variant: "destructive",
+        });
+      },
+    });
+  };
+
+  return (
+    <>
+      <Helmet>
+        <title>Create Policy - Probo Console</title>
+      </Helmet>
+      <div className="container mx-auto py-6">
+        <div className="flex items-center mb-6">
+          <div className="mr-4">
+            <div className="flex h-12 w-12 items-center justify-center rounded-lg bg-primary/10">
+              <FileText className="h-6 w-6 text-primary" />
+            </div>
+          </div>
+          <div>
+            <h1 className="text-2xl font-bold">Create Policy</h1>
+            <p className="text-muted-foreground">
+              Create a new policy for your organization
+            </p>
+          </div>
+        </div>
+
+        <form onSubmit={handleSubmit}>
+          <div className="grid gap-6">
+            <Card>
+              <CardHeader>
+                <CardTitle>Policy Information</CardTitle>
+              </CardHeader>
+              <CardContent className="space-y-4">
+                <div className="space-y-2">
+                  <Label htmlFor="name">Policy Name</Label>
+                  <Input
+                    id="name"
+                    placeholder="Enter policy name"
+                    value={name}
+                    onChange={(e) => setName(e.target.value)}
+                    required
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label htmlFor="content">Policy Content</Label>
+                  <Textarea
+                    id="content"
+                    placeholder="Enter policy content"
+                    value={content}
+                    onChange={(e) => setContent(e.target.value)}
+                    className="min-h-[200px]"
+                    required
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label>Status</Label>
+                  <RadioGroup
+                    value={status}
+                    onValueChange={(value: "DRAFT" | "ACTIVE") =>
+                      setStatus(value)
+                    }
+                    className="flex space-x-4"
+                  >
+                    <div className="flex items-center space-x-2">
+                      <RadioGroupItem value="DRAFT" id="draft" />
+                      <Label htmlFor="draft" className="cursor-pointer">
+                        Draft
+                      </Label>
+                    </div>
+                    <div className="flex items-center space-x-2">
+                      <RadioGroupItem value="ACTIVE" id="active" />
+                      <Label htmlFor="active" className="cursor-pointer">
+                        Active
+                      </Label>
+                    </div>
+                  </RadioGroup>
+                </div>
+              </CardContent>
+            </Card>
+
+            <div className="flex justify-end gap-4">
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() =>
+                  navigate(`/organizations/${organizationId}/policies`)
+                }
+              >
+                Cancel
+              </Button>
+              <Button type="submit" disabled={isSubmitting}>
+                {isSubmitting ? "Creating..." : "Create Policy"}
+              </Button>
+            </div>
+          </div>
+        </form>
+      </div>
+    </>
+  );
+}
diff --git a/apps/console/src/pages/PolicyListPage.tsx b/apps/console/src/pages/PolicyListPage.tsx
new file mode 100644
index 000000000..1451368dc
--- /dev/null
+++ b/apps/console/src/pages/PolicyListPage.tsx
@@ -0,0 +1,179 @@
+import { Suspense, useEffect } from "react";
+import {
+  graphql,
+  PreloadedQuery,
+  usePreloadedQuery,
+  useQueryLoader,
+} from "react-relay";
+import { Card, CardContent } from "@/components/ui/card";
+import { Link, useParams } from "react-router";
+import { Helmet } from "react-helmet-async";
+import { Button } from "@/components/ui/button";
+import { Plus, FileText } from "lucide-react";
+import type { PolicyListPageQuery as PolicyListPageQueryType } from "./__generated__/PolicyListPageQuery.graphql";
+
+const PolicyListPageQuery = graphql`
+  query PolicyListPageQuery($organizationId: ID!) {
+    organization: node(id: $organizationId) {
+      ... on Organization {
+        policies(first: 25) @connection(key: "PolicyListPage_policies") {
+          edges {
+            node {
+              id
+              name
+              createdAt
+              updatedAt
+              status
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+function PolicyCard({
+  title,
+  icon,
+  status,
+}: {
+  title: string;
+  icon: React.ReactNode;
+  status?: string;
+}) {
+  return (
+    <Card className="relative overflow-hidden border bg-card p-6">
+      <div className="flex flex-col gap-4">
+        <div className="size-16">{icon}</div>
+
+        <div className="space-y-2">
+          <div className="flex items-center gap-2">
+            <h3 className="font-semibold">{title}</h3>
+            {status && (
+              <span
+                className={`rounded-full px-2 py-0.5 text-xs ${
+                  status === "ACTIVE"
+                    ? "bg-green-100 text-green-700"
+                    : status === "DRAFT"
+                    ? "bg-yellow-100 text-yellow-700"
+                    : "bg-gray-100 text-gray-700"
+                }`}
+              >
+                {status === "ACTIVE"
+                  ? "Active"
+                  : status === "DRAFT"
+                  ? "Draft"
+                  : status}
+              </span>
+            )}
+          </div>
+        </div>
+      </div>
+    </Card>
+  );
+}
+
+function PolicyListPageContent({
+  queryRef,
+}: {
+  queryRef: PreloadedQuery<PolicyListPageQueryType>;
+}) {
+  const data = usePreloadedQuery<PolicyListPageQueryType>(
+    PolicyListPageQuery,
+    queryRef
+  );
+  const { organizationId } = useParams();
+  const policies =
+    data.organization.policies?.edges.map((edge) => edge?.node) ?? [];
+
+  return (
+    <>
+      <Helmet>
+        <title>Policies - Probo</title>
+      </Helmet>
+      <div className="container mx-auto py-6">
+        <div className="flex justify-between items-center mb-6">
+          <div>
+            <h1 className="text-2xl font-bold">Policies</h1>
+            <p className="text-muted-foreground">
+              Manage your organization{"'"}s policies
+            </p>
+          </div>
+          <Button asChild>
+            <Link to={`/organizations/${organizationId}/policies/create`}>
+              <Plus className="mr-2 h-4 w-4" />
+              Create Policy
+            </Link>
+          </Button>
+        </div>
+        <div className="space-y-6">
+          <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-3">
+            {policies.map((policy) => (
+              <Link
+                key={policy.id}
+                to={`/organizations/${organizationId}/policies/${policy.id}`}
+              >
+                <PolicyCard
+                  title={policy.name}
+                  icon={
+                    <div className="flex size-full items-center justify-center rounded-full bg-blue-100">
+                      <FileText className="h-8 w-8 text-blue-900" />
+                    </div>
+                  }
+                  status={policy.status}
+                />
+              </Link>
+            ))}
+          </div>
+        </div>
+      </div>
+    </>
+  );
+}
+
+function PolicyListPageFallback() {
+  return (
+    <div className="space-y-6">
+      <div>
+        <div className="h-8 w-48 bg-muted animate-pulse rounded" />
+        <div className="h-4 w-96 bg-muted animate-pulse rounded mt-1" />
+      </div>
+      <div className="grid gap-6 md:grid-cols-2 lg:grid-cols-3">
+        {[1, 2, 3].map((i) => (
+          <Card key={i} className="bg-card/50">
+            <CardContent className="p-6">
+              <div className="relative mb-6">
+                <div className="bg-muted w-24 h-24 rounded-full animate-pulse mb-4" />
+                <div className="h-6 w-48 bg-muted animate-pulse rounded mb-2" />
+                <div className="h-20 w-full bg-muted animate-pulse rounded" />
+              </div>
+              <div className="h-4 w-32 bg-muted animate-pulse rounded" />
+            </CardContent>
+          </Card>
+        ))}
+      </div>
+    </div>
+  );
+}
+
+export default function PolicyListPage() {
+  const [queryRef, loadQuery] =
+    useQueryLoader<PolicyListPageQueryType>(PolicyListPageQuery);
+
+  const { organizationId } = useParams();
+
+  useEffect(() => {
+    loadQuery({ organizationId: organizationId! });
+  }, [loadQuery, organizationId]);
+
+  return (
+    <>
+      <Helmet>
+        <title>Policies - Probo Console</title>
+      </Helmet>
+      <Suspense fallback={<PolicyListPageFallback />}>
+        {queryRef && <PolicyListPageContent queryRef={queryRef} />}
+      </Suspense>
+    </>
+  );
+}
diff --git a/apps/console/src/pages/PolicyOverviewPage.tsx b/apps/console/src/pages/PolicyOverviewPage.tsx
new file mode 100644
index 000000000..5366573b1
--- /dev/null
+++ b/apps/console/src/pages/PolicyOverviewPage.tsx
@@ -0,0 +1,230 @@
+import { Suspense, useEffect } from "react";
+import { useParams, Link } from "react-router";
+import {
+  graphql,
+  PreloadedQuery,
+  usePreloadedQuery,
+  useQueryLoader,
+} from "react-relay";
+import { Edit } from "lucide-react";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
+import type { PolicyOverviewPageQuery as PolicyOverviewPageQueryType } from "./__generated__/PolicyOverviewPageQuery.graphql";
+import { Helmet } from "react-helmet-async";
+
+const PolicyOverviewPageQuery = graphql`
+  query PolicyOverviewPageQuery($policyId: ID!) {
+    node(id: $policyId) {
+      id
+      ... on Policy {
+        name
+        content
+        createdAt
+        updatedAt
+        status
+      }
+    }
+  }
+`;
+
+function PolicyOverviewPageContent({
+  queryRef,
+}: {
+  queryRef: PreloadedQuery<PolicyOverviewPageQueryType>;
+}) {
+  const data = usePreloadedQuery(PolicyOverviewPageQuery, queryRef);
+  const policy = data.node;
+  const { organizationId } = useParams();
+
+  const getStatusBadge = (status: string | undefined) => {
+    if (!status) return null;
+
+    switch (status) {
+      case "ACTIVE":
+        return (
+          <Badge className="bg-green-100 text-green-700 hover:bg-green-200">
+            Active
+          </Badge>
+        );
+      case "DRAFT":
+        return (
+          <Badge className="bg-yellow-100 text-yellow-700 hover:bg-yellow-200">
+            Draft
+          </Badge>
+        );
+      default:
+        return (
+          <Badge className="bg-gray-100 text-gray-700 hover:bg-gray-200">
+            {status}
+          </Badge>
+        );
+    }
+  };
+
+  const formatDate = (dateString: string | undefined) => {
+    if (!dateString) return "N/A";
+
+    const date = new Date(dateString);
+    return new Intl.DateTimeFormat("en-US", {
+      year: "numeric",
+      month: "long",
+      day: "numeric",
+      hour: "2-digit",
+      minute: "2-digit",
+    }).format(date);
+  };
+
+  return (
+    <div className="min-h-screen bg-background p-6 space-y-6">
+      <div className="space-y-4 mb-8">
+        <div className="flex justify-between items-center">
+          <div>
+            <h2 className="text-2xl font-semibold mb-1">{policy.name}</h2>
+          </div>
+          <div className="flex gap-2">
+            <Button variant="outline" asChild>
+              <Link
+                to={`/organizations/${organizationId}/policies/${policy.id}/update`}
+              >
+                <Edit className="mr-2 h-4 w-4" />
+                Edit Policy
+              </Link>
+            </Button>
+          </div>
+        </div>
+      </div>
+
+      <div className="grid grid-cols-1 md:grid-cols-3 gap-6">
+        <div className="md:col-span-2">
+          <Card>
+            <CardHeader>
+              <CardTitle>Policy Content</CardTitle>
+            </CardHeader>
+            <CardContent>
+              <div className="prose max-w-none">
+                <div
+                  dangerouslySetInnerHTML={{ __html: policy.content || "" }}
+                />
+              </div>
+            </CardContent>
+          </Card>
+        </div>
+
+        <div>
+          <Card>
+            <CardHeader>
+              <CardTitle>Policy Details</CardTitle>
+            </CardHeader>
+            <CardContent>
+              <div className="space-y-4">
+                <div>
+                  <h4 className="text-sm font-medium text-muted-foreground mb-1">
+                    Status
+                  </h4>
+                  <div>{getStatusBadge(policy.status)}</div>
+                </div>
+                <div>
+                  <h4 className="text-sm font-medium text-muted-foreground mb-1">
+                    Created
+                  </h4>
+                  <p>{formatDate(policy.createdAt)}</p>
+                </div>
+                <div>
+                  <h4 className="text-sm font-medium text-muted-foreground mb-1">
+                    Last Updated
+                  </h4>
+                  <p>{formatDate(policy.updatedAt)}</p>
+                </div>
+              </div>
+            </CardContent>
+          </Card>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function PolicyOverviewPageFallback() {
+  return (
+    <div className="min-h-screen bg-background p-6 space-y-6">
+      <div className="space-y-4 mb-8">
+        <div className="flex justify-between items-center">
+          <div>
+            <div className="h-8 w-48 bg-muted animate-pulse rounded mb-2" />
+            <div className="h-4 w-96 bg-muted animate-pulse rounded" />
+          </div>
+          <div>
+            <div className="h-10 w-32 bg-muted animate-pulse rounded" />
+          </div>
+        </div>
+      </div>
+
+      <div className="grid grid-cols-1 md:grid-cols-3 gap-6">
+        <div className="md:col-span-2">
+          <Card>
+            <CardHeader>
+              <div className="h-6 w-32 bg-muted animate-pulse rounded" />
+            </CardHeader>
+            <CardContent>
+              <div className="space-y-4">
+                <div className="h-4 w-full bg-muted animate-pulse rounded" />
+                <div className="h-4 w-full bg-muted animate-pulse rounded" />
+                <div className="h-4 w-3/4 bg-muted animate-pulse rounded" />
+                <div className="h-4 w-full bg-muted animate-pulse rounded" />
+                <div className="h-4 w-5/6 bg-muted animate-pulse rounded" />
+              </div>
+            </CardContent>
+          </Card>
+        </div>
+
+        <div>
+          <Card>
+            <CardHeader>
+              <div className="h-6 w-32 bg-muted animate-pulse rounded" />
+            </CardHeader>
+            <CardContent>
+              <div className="space-y-4">
+                <div>
+                  <div className="h-4 w-16 bg-muted animate-pulse rounded mb-2" />
+                  <div className="h-6 w-24 bg-muted animate-pulse rounded" />
+                </div>
+                <div>
+                  <div className="h-4 w-16 bg-muted animate-pulse rounded mb-2" />
+                  <div className="h-6 w-48 bg-muted animate-pulse rounded" />
+                </div>
+                <div>
+                  <div className="h-4 w-24 bg-muted animate-pulse rounded mb-2" />
+                  <div className="h-6 w-48 bg-muted animate-pulse rounded" />
+                </div>
+              </div>
+            </CardContent>
+          </Card>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+export default function PolicyOverviewPage() {
+  const [queryRef, loadQuery] = useQueryLoader<PolicyOverviewPageQueryType>(
+    PolicyOverviewPageQuery
+  );
+
+  const { policyId } = useParams();
+
+  useEffect(() => {
+    loadQuery({ policyId: policyId! });
+  }, [loadQuery, policyId]);
+
+  return (
+    <>
+      <Helmet>
+        <title>Policy Details - Probo Console</title>
+      </Helmet>
+      <Suspense fallback={<PolicyOverviewPageFallback />}>
+        {queryRef && <PolicyOverviewPageContent queryRef={queryRef} />}
+      </Suspense>
+    </>
+  );
+}
diff --git a/apps/console/src/pages/UpdatePolicyPage.tsx b/apps/console/src/pages/UpdatePolicyPage.tsx
new file mode 100644
index 000000000..87fcf2f62
--- /dev/null
+++ b/apps/console/src/pages/UpdatePolicyPage.tsx
@@ -0,0 +1,270 @@
+import { useState, useEffect } from "react";
+import { useNavigate, useParams } from "react-router";
+import {
+  graphql,
+  useMutation,
+  usePreloadedQuery,
+  useQueryLoader,
+  PreloadedQuery,
+} from "react-relay";
+import { Helmet } from "react-helmet-async";
+import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { Textarea } from "@/components/ui/textarea";
+import { toast } from "@/hooks/use-toast";
+import { FileText } from "lucide-react";
+import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group";
+import { Suspense } from "react";
+import type { UpdatePolicyPageQuery as UpdatePolicyPageQueryType } from "./__generated__/UpdatePolicyPageQuery.graphql";
+import type { UpdatePolicyPageMutation as UpdatePolicyPageMutationType } from "./__generated__/UpdatePolicyPageMutation.graphql";
+
+const UpdatePolicyPageQuery = graphql`
+  query UpdatePolicyPageQuery($policyId: ID!) {
+    node(id: $policyId) {
+      id
+      ... on Policy {
+        name
+        content
+        status
+        version
+      }
+    }
+  }
+`;
+
+const UpdatePolicyMutation = graphql`
+  mutation UpdatePolicyPageMutation($input: UpdatePolicyInput!) {
+    updatePolicy(input: $input) {
+      policy {
+        id
+        name
+        content
+        status
+      }
+    }
+  }
+`;
+
+function UpdatePolicyPageContent({
+  queryRef,
+}: {
+  queryRef: PreloadedQuery<UpdatePolicyPageQueryType>;
+}) {
+  const navigate = useNavigate();
+  const { organizationId, policyId } = useParams();
+  const data = usePreloadedQuery<UpdatePolicyPageQueryType>(
+    UpdatePolicyPageQuery,
+    queryRef
+  );
+
+  const [name, setName] = useState(data.node.name);
+  const [content, setContent] = useState(data.node.content);
+  const [status, setStatus] = useState(data.node.status);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  const [commitMutation] =
+    useMutation<UpdatePolicyPageMutationType>(UpdatePolicyMutation);
+
+  const handleSubmit = (e: React.FormEvent) => {
+    e.preventDefault();
+    setIsSubmitting(true);
+
+    commitMutation({
+      variables: {
+        input: {
+          id: data.node.id,
+          name,
+          content,
+          status,
+          expectedVersion: data.node.version!,
+        },
+      },
+      onCompleted: (response, errors) => {
+        setIsSubmitting(false);
+        if (errors) {
+          console.error("Error updating policy:", errors);
+          toast({
+            title: "Error",
+            description: "Failed to update policy. Please try again.",
+            variant: "destructive",
+          });
+          return;
+        }
+
+        toast({
+          title: "Success",
+          description: "Policy updated successfully!",
+        });
+
+        navigate(
+          `/organizations/${organizationId}/policies/${response.updatePolicy.policy.id}`
+        );
+      },
+      onError: (error) => {
+        setIsSubmitting(false);
+        console.error("Error updating policy:", error);
+        toast({
+          title: "Error",
+          description: "Failed to update policy. Please try again.",
+          variant: "destructive",
+        });
+      },
+    });
+  };
+
+  return (
+    <>
+      <Helmet>
+        <title>Update Policy - Probo Console</title>
+      </Helmet>
+      <div className="container mx-auto py-6">
+        <div className="flex items-center mb-6">
+          <div className="mr-4">
+            <div className="flex h-12 w-12 items-center justify-center rounded-lg bg-primary/10">
+              <FileText className="h-6 w-6 text-primary" />
+            </div>
+          </div>
+          <div>
+            <h1 className="text-2xl font-bold">Update Policy</h1>
+            <p className="text-muted-foreground">Update an existing policy</p>
+          </div>
+        </div>
+
+        <form onSubmit={handleSubmit}>
+          <div className="grid gap-6">
+            <Card>
+              <CardHeader>
+                <CardTitle>Policy Information</CardTitle>
+              </CardHeader>
+              <CardContent className="space-y-4">
+                <div className="space-y-2">
+                  <Label htmlFor="name">Policy Name</Label>
+                  <Input
+                    id="name"
+                    placeholder="Enter policy name"
+                    value={name}
+                    onChange={(e) => setName(e.target.value)}
+                    required
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label htmlFor="content">Policy Content</Label>
+                  <Textarea
+                    id="content"
+                    placeholder="Enter policy content"
+                    value={content}
+                    onChange={(e) => setContent(e.target.value)}
+                    className="min-h-[200px]"
+                    required
+                  />
+                </div>
+
+                <div className="space-y-2">
+                  <Label>Status</Label>
+                  <RadioGroup
+                    value={status}
+                    onValueChange={(value) =>
+                      setStatus(value as "DRAFT" | "ACTIVE")
+                    }
+                    className="flex space-x-4"
+                  >
+                    <div className="flex items-center space-x-2">
+                      <RadioGroupItem value="DRAFT" id="draft" />
+                      <Label htmlFor="draft" className="cursor-pointer">
+                        Draft
+                      </Label>
+                    </div>
+                    <div className="flex items-center space-x-2">
+                      <RadioGroupItem value="ACTIVE" id="active" />
+                      <Label htmlFor="active" className="cursor-pointer">
+                        Active
+                      </Label>
+                    </div>
+                  </RadioGroup>
+                </div>
+              </CardContent>
+            </Card>
+
+            <div className="flex justify-end gap-4">
+              <Button
+                type="button"
+                variant="outline"
+                onClick={() =>
+                  navigate(
+                    `/organizations/${organizationId}/policies/${policyId}`
+                  )
+                }
+              >
+                Cancel
+              </Button>
+              <Button type="submit" disabled={isSubmitting}>
+                {isSubmitting ? "Updating..." : "Update Policy"}
+              </Button>
+            </div>
+          </div>
+        </form>
+      </div>
+    </>
+  );
+}
+
+function UpdatePolicyPageFallback() {
+  return (
+    <div className="container mx-auto py-6">
+      <div className="flex items-center mb-6">
+        <div className="mr-4">
+          <div className="h-12 w-12 bg-muted animate-pulse rounded-lg" />
+        </div>
+        <div>
+          <div className="h-8 w-48 bg-muted animate-pulse rounded mb-2" />
+          <div className="h-4 w-64 bg-muted animate-pulse rounded" />
+        </div>
+      </div>
+
+      <div className="grid gap-6">
+        <Card>
+          <CardHeader>
+            <div className="h-6 w-32 bg-muted animate-pulse rounded" />
+          </CardHeader>
+          <CardContent className="space-y-4">
+            {[1, 2, 3, 4].map((i) => (
+              <div key={i} className="space-y-2">
+                <div className="h-4 w-24 bg-muted animate-pulse rounded" />
+                <div className="h-10 w-full bg-muted animate-pulse rounded" />
+              </div>
+            ))}
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+}
+
+export default function UpdatePolicyPage() {
+  const [queryRef, loadQuery] = useQueryLoader<UpdatePolicyPageQueryType>(
+    UpdatePolicyPageQuery
+  );
+  const { policyId } = useParams();
+
+  useEffect(() => {
+    loadQuery({ policyId: policyId! });
+  }, [loadQuery, policyId]);
+
+  if (!queryRef) {
+    return <UpdatePolicyPageFallback />;
+  }
+
+  return (
+    <>
+      <Helmet>
+        <title>Update Policy - Probo Console</title>
+      </Helmet>
+      <Suspense fallback={<UpdatePolicyPageFallback />}>
+        <UpdatePolicyPageContent queryRef={queryRef} />
+      </Suspense>
+    </>
+  );
+}
diff --git a/apps/console/src/pages/__generated__/CreatePolicyPageMutation.graphql.ts b/apps/console/src/pages/__generated__/CreatePolicyPageMutation.graphql.ts
new file mode 100644
index 000000000..ff9d670a4
--- /dev/null
+++ b/apps/console/src/pages/__generated__/CreatePolicyPageMutation.graphql.ts
@@ -0,0 +1,186 @@
+/**
+ * @generated SignedSource<<c20ef485780e9d9544f536609ae060af>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type PolicyStatus = "ACTIVE" | "DRAFT";
+export type CreatePolicyInput = {
+  content: string;
+  name: string;
+  organizationId: string;
+  status: PolicyStatus;
+};
+export type CreatePolicyPageMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreatePolicyInput;
+};
+export type CreatePolicyPageMutation$data = {
+  readonly createPolicy: {
+    readonly policyEdge: {
+      readonly node: {
+        readonly content: string;
+        readonly id: string;
+        readonly name: string;
+        readonly status: PolicyStatus;
+      };
+    };
+  };
+};
+export type CreatePolicyPageMutation = {
+  response: CreatePolicyPageMutation$data;
+  variables: CreatePolicyPageMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "PolicyEdge",
+  "kind": "LinkedField",
+  "name": "policyEdge",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "Policy",
+      "kind": "LinkedField",
+      "name": "node",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "id",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "content",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "status",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "CreatePolicyPageMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreatePolicyPayload",
+        "kind": "LinkedField",
+        "name": "createPolicy",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "CreatePolicyPageMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreatePolicyPayload",
+        "kind": "LinkedField",
+        "name": "createPolicy",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "policyEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "f9d97eecb99b47365557e372c724af41",
+    "id": null,
+    "metadata": {},
+    "name": "CreatePolicyPageMutation",
+    "operationKind": "mutation",
+    "text": "mutation CreatePolicyPageMutation(\n  $input: CreatePolicyInput!\n) {\n  createPolicy(input: $input) {\n    policyEdge {\n      node {\n        id\n        name\n        content\n        status\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "dca08dd146693bcf614e7d02785e57b5";
+
+export default node;
diff --git a/apps/console/src/pages/__generated__/PolicyListPageQuery.graphql.ts b/apps/console/src/pages/__generated__/PolicyListPageQuery.graphql.ts
new file mode 100644
index 000000000..88f4175c2
--- /dev/null
+++ b/apps/console/src/pages/__generated__/PolicyListPageQuery.graphql.ts
@@ -0,0 +1,269 @@
+/**
+ * @generated SignedSource<<4225a13c40221ef783ffebcfda157db9>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type PolicyStatus = "ACTIVE" | "DRAFT";
+export type PolicyListPageQuery$variables = {
+  organizationId: string;
+};
+export type PolicyListPageQuery$data = {
+  readonly organization: {
+    readonly policies?: {
+      readonly edges: ReadonlyArray<{
+        readonly node: {
+          readonly createdAt: string;
+          readonly id: string;
+          readonly name: string;
+          readonly status: PolicyStatus;
+          readonly updatedAt: string;
+        };
+      }>;
+    };
+  };
+};
+export type PolicyListPageQuery = {
+  response: PolicyListPageQuery$data;
+  variables: PolicyListPageQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "organizationId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "organizationId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+},
+v4 = [
+  {
+    "alias": null,
+    "args": null,
+    "concreteType": "PolicyEdge",
+    "kind": "LinkedField",
+    "name": "edges",
+    "plural": true,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "Policy",
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v2/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "name",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "createdAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "updatedAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "status",
+            "storageKey": null
+          },
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "cursor",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  },
+  {
+    "alias": null,
+    "args": null,
+    "concreteType": "PageInfo",
+    "kind": "LinkedField",
+    "name": "pageInfo",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "endCursor",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "hasNextPage",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+],
+v5 = [
+  {
+    "kind": "Literal",
+    "name": "first",
+    "value": 25
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "PolicyListPageQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": "policies",
+                "args": null,
+                "concreteType": "PolicyConnection",
+                "kind": "LinkedField",
+                "name": "__PolicyListPage_policies_connection",
+                "plural": false,
+                "selections": (v4/*: any*/),
+                "storageKey": null
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "PolicyListPageQuery",
+    "selections": [
+      {
+        "alias": "organization",
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v5/*: any*/),
+                "concreteType": "PolicyConnection",
+                "kind": "LinkedField",
+                "name": "policies",
+                "plural": false,
+                "selections": (v4/*: any*/),
+                "storageKey": "policies(first:25)"
+              },
+              {
+                "alias": null,
+                "args": (v5/*: any*/),
+                "filters": null,
+                "handle": "connection",
+                "key": "PolicyListPage_policies",
+                "kind": "LinkedHandle",
+                "name": "policies"
+              }
+            ],
+            "type": "Organization",
+            "abstractKey": null
+          },
+          (v2/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "abc2b7659c3b58aa3df934d4ee3aa78a",
+    "id": null,
+    "metadata": {
+      "connection": [
+        {
+          "count": null,
+          "cursor": null,
+          "direction": "forward",
+          "path": [
+            "organization",
+            "policies"
+          ]
+        }
+      ]
+    },
+    "name": "PolicyListPageQuery",
+    "operationKind": "query",
+    "text": "query PolicyListPageQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      policies(first: 25) {\n        edges {\n          node {\n            id\n            name\n            createdAt\n            updatedAt\n            status\n            __typename\n          }\n          cursor\n        }\n        pageInfo {\n          endCursor\n          hasNextPage\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "75262b569185ae2e6bfda8c19fd7ac9d";
+
+export default node;
diff --git a/apps/console/src/pages/__generated__/PolicyOverviewPageQuery.graphql.ts b/apps/console/src/pages/__generated__/PolicyOverviewPageQuery.graphql.ts
new file mode 100644
index 000000000..71d9f7f19
--- /dev/null
+++ b/apps/console/src/pages/__generated__/PolicyOverviewPageQuery.graphql.ts
@@ -0,0 +1,160 @@
+/**
+ * @generated SignedSource<<be4844f007d260c332082a01fe125a57>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type PolicyStatus = "ACTIVE" | "DRAFT";
+export type PolicyOverviewPageQuery$variables = {
+  policyId: string;
+};
+export type PolicyOverviewPageQuery$data = {
+  readonly node: {
+    readonly content?: string;
+    readonly createdAt?: string;
+    readonly id: string;
+    readonly name?: string;
+    readonly status?: PolicyStatus;
+    readonly updatedAt?: string;
+  };
+};
+export type PolicyOverviewPageQuery = {
+  response: PolicyOverviewPageQuery$data;
+  variables: PolicyOverviewPageQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "policyId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "policyId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "name",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "content",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "createdAt",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "updatedAt",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "status",
+      "storageKey": null
+    }
+  ],
+  "type": "Policy",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "PolicyOverviewPageQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "PolicyOverviewPageQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "07fedea13b4dbbe58e15dfaa644b24fa",
+    "id": null,
+    "metadata": {},
+    "name": "PolicyOverviewPageQuery",
+    "operationKind": "query",
+    "text": "query PolicyOverviewPageQuery(\n  $policyId: ID!\n) {\n  node(id: $policyId) {\n    __typename\n    id\n    ... on Policy {\n      name\n      content\n      createdAt\n      updatedAt\n      status\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "17389d925f3f3ffa3ed5eb8ed9051ae9";
+
+export default node;
diff --git a/apps/console/src/pages/__generated__/UpdatePolicyPageMutation.graphql.ts b/apps/console/src/pages/__generated__/UpdatePolicyPageMutation.graphql.ts
new file mode 100644
index 000000000..36a49233b
--- /dev/null
+++ b/apps/console/src/pages/__generated__/UpdatePolicyPageMutation.graphql.ts
@@ -0,0 +1,134 @@
+/**
+ * @generated SignedSource<<beb534549abc2d40828f7a5d0aaa96e6>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type PolicyStatus = "ACTIVE" | "DRAFT";
+export type UpdatePolicyInput = {
+  content?: string | null | undefined;
+  expectedVersion: number;
+  id: string;
+  name?: string | null | undefined;
+  status?: PolicyStatus | null | undefined;
+};
+export type UpdatePolicyPageMutation$variables = {
+  input: UpdatePolicyInput;
+};
+export type UpdatePolicyPageMutation$data = {
+  readonly updatePolicy: {
+    readonly policy: {
+      readonly content: string;
+      readonly id: string;
+      readonly name: string;
+      readonly status: PolicyStatus;
+    };
+  };
+};
+export type UpdatePolicyPageMutation = {
+  response: UpdatePolicyPageMutation$data;
+  variables: UpdatePolicyPageMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "UpdatePolicyPayload",
+    "kind": "LinkedField",
+    "name": "updatePolicy",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "Policy",
+        "kind": "LinkedField",
+        "name": "policy",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "id",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "name",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "content",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "status",
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "UpdatePolicyPageMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "UpdatePolicyPageMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "712914b4586e7c5f722f908c8d64bbc1",
+    "id": null,
+    "metadata": {},
+    "name": "UpdatePolicyPageMutation",
+    "operationKind": "mutation",
+    "text": "mutation UpdatePolicyPageMutation(\n  $input: UpdatePolicyInput!\n) {\n  updatePolicy(input: $input) {\n    policy {\n      id\n      name\n      content\n      status\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "25a2ddb0078d821584c5497227a6d364";
+
+export default node;
diff --git a/apps/console/src/pages/__generated__/UpdatePolicyPageQuery.graphql.ts b/apps/console/src/pages/__generated__/UpdatePolicyPageQuery.graphql.ts
new file mode 100644
index 000000000..9b42e8289
--- /dev/null
+++ b/apps/console/src/pages/__generated__/UpdatePolicyPageQuery.graphql.ts
@@ -0,0 +1,152 @@
+/**
+ * @generated SignedSource<<b7ecab3dac17a6d1b23ec639484a4322>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type PolicyStatus = "ACTIVE" | "DRAFT";
+export type UpdatePolicyPageQuery$variables = {
+  policyId: string;
+};
+export type UpdatePolicyPageQuery$data = {
+  readonly node: {
+    readonly content?: string;
+    readonly id: string;
+    readonly name?: string;
+    readonly status?: PolicyStatus;
+    readonly version?: number;
+  };
+};
+export type UpdatePolicyPageQuery = {
+  response: UpdatePolicyPageQuery$data;
+  variables: UpdatePolicyPageQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "policyId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "policyId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "InlineFragment",
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "name",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "content",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "status",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "version",
+      "storageKey": null
+    }
+  ],
+  "type": "Policy",
+  "abstractKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "UpdatePolicyPageQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "UpdatePolicyPageQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "__typename",
+            "storageKey": null
+          },
+          (v2/*: any*/),
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "ed70bb0199119ba5b9080ed86081ac79",
+    "id": null,
+    "metadata": {},
+    "name": "UpdatePolicyPageQuery",
+    "operationKind": "query",
+    "text": "query UpdatePolicyPageQuery(\n  $policyId: ID!\n) {\n  node(id: $policyId) {\n    __typename\n    id\n    ... on Policy {\n      name\n      content\n      status\n      version\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "303abaec54b66ef4f5c886d1cd606f12";
+
+export default node;
diff --git a/package-lock.json b/package-lock.json
index 809086965..7ca4be1d5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,12 +18,14 @@
       "name": "@probo/console",
       "version": "0.0.1",
       "dependencies": {
+        "@hookform/resolvers": "^4.1.3",
+        "@radix-ui/react-alert-dialog": "^1.1.6",
         "@radix-ui/react-avatar": "^1.1.3",
         "@radix-ui/react-checkbox": "^1.0.4",
         "@radix-ui/react-collapsible": "^1.1.3",
         "@radix-ui/react-dialog": "^1.1.6",
         "@radix-ui/react-dropdown-menu": "^2.1.6",
-        "@radix-ui/react-label": "^2.0.2",
+        "@radix-ui/react-label": "^2.1.2",
         "@radix-ui/react-progress": "^1.1.2",
         "@radix-ui/react-radio-group": "^1.1.3",
         "@radix-ui/react-select": "^2.0.0",
@@ -39,11 +41,13 @@
         "react": "^18.3.1",
         "react-dom": "^18.3.1",
         "react-helmet-async": "^2.0.5",
+        "react-hook-form": "^7.54.2",
         "react-relay": "^18.2.0",
         "react-router": "^7.1.5",
         "relay-runtime": "^18.2.0",
         "tailwind-merge": "^3.0.1",
-        "tailwindcss-animate": "^1.0.7"
+        "tailwindcss-animate": "^1.0.7",
+        "zod": "^3.24.2"
       },
       "devDependencies": {
         "@babel/core": "^7.26.7",
@@ -2378,6 +2382,18 @@
       "integrity": "sha512-MDWhGtE+eHw5JW7lq4qhc5yRLS11ERl1c7Z6Xd0a58DozHES6EnNNwUWbMiG4J9Cgj053Bhk8zvlhFYKVhULwg==",
       "license": "MIT"
     },
+    "node_modules/@hookform/resolvers": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/@hookform/resolvers/-/resolvers-4.1.3.tgz",
+      "integrity": "sha512-Jsv6UOWYTrEFJ/01ZrnwVXs7KDvP8XIo115i++5PWvNkNvkrsTfGiLS6w+eJ57CYtUtDQalUWovCZDHFJ8u1VQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/utils": "^0.3.0"
+      },
+      "peerDependencies": {
+        "react-hook-form": "^7.0.0"
+      }
+    },
     "node_modules/@humanfs/core": {
       "version": "0.19.1",
       "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
@@ -2559,6 +2575,34 @@
       "integrity": "sha512-SJ31y+Q/zAyShtXJc8x83i9TYdbAfHZ++tUZnvjJJqFjzsdUnKsxPL6IEtBlxKkU7yzer//GQtZSV4GbldL3YA==",
       "license": "MIT"
     },
+    "node_modules/@radix-ui/react-alert-dialog": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-alert-dialog/-/react-alert-dialog-1.1.6.tgz",
+      "integrity": "sha512-p4XnPqgej8sZAAReCAKgz1REYZEBLR8hU9Pg27wFnCWIMc8g1ccCs0FjBcy05V15VTu8pAePw/VDYeOm/uZ6yQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.1",
+        "@radix-ui/react-compose-refs": "1.1.1",
+        "@radix-ui/react-context": "1.1.1",
+        "@radix-ui/react-dialog": "1.1.6",
+        "@radix-ui/react-primitive": "2.0.2",
+        "@radix-ui/react-slot": "1.1.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@radix-ui/react-arrow": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.2.tgz",
@@ -3440,6 +3484,12 @@
       "integrity": "sha512-A9+lCBZoaMJlVKcRBz2YByCG+Cp2t6nAnMnNba+XiWxnj6r4JUFqfsgwocMBZU9LPtdxC6wB56ySYpc7LQIoJg==",
       "license": "MIT"
     },
+    "node_modules/@standard-schema/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
+      "license": "MIT"
+    },
     "node_modules/@tailwindcss/node": {
       "version": "4.0.9",
       "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.0.9.tgz",
@@ -7417,6 +7467,22 @@
         "react": "^16.6.0 || ^17.0.0 || ^18.0.0"
       }
     },
+    "node_modules/react-hook-form": {
+      "version": "7.54.2",
+      "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.54.2.tgz",
+      "integrity": "sha512-eHpAUgUjWbZocoQYUHposymRb4ZP6d0uwUnooL2uOybA9/3tPUvoAKqEWK1WaSiTxxOfTpffNZP7QwlnM3/gEg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/react-hook-form"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17 || ^18 || ^19"
+      }
+    },
     "node_modules/react-is": {
       "version": "16.13.1",
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
@@ -8697,6 +8763,15 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/zod": {
+      "version": "3.24.2",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-3.24.2.tgz",
+      "integrity": "sha512-lY7CDW43ECgW9u1TcT3IoXHflywfVqDYze4waEz812jR/bZ8FHDsl7pFQoSZTz5N+2NqRXs8GBwnAwo3ZNxqhQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
     "packages/esbuild-plugin-postcss": {
       "name": "@probo/esbuild-plugin-postcss",
       "version": "0.0.1",
diff --git a/pkg/api/console/v1/schema.graphql b/pkg/api/console/v1/schema.graphql
index 78472298d..c08422d62 100644
--- a/pkg/api/console/v1/schema.graphql
+++ b/pkg/api/console/v1/schema.graphql
@@ -121,6 +121,13 @@ type Organization implements Node {
     before: CursorKey
   ): PeopleConnection! @goField(forceResolver: true)
 
+  policies(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): PolicyConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -404,6 +411,9 @@ type Mutation {
   updateControl(input: UpdateControlInput!): UpdateControlPayload!
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
+  createPolicy(input: CreatePolicyInput!): CreatePolicyPayload!
+  updatePolicy(input: UpdatePolicyInput!): UpdatePolicyPayload!
+  deletePolicy(input: DeletePolicyInput!): DeletePolicyPayload!
 }
 
 input CreateVendorInput {
@@ -621,3 +631,66 @@ input DeleteEvidenceInput {
 type DeleteEvidencePayload {
   deletedEvidenceId: ID!
 }
+
+enum PolicyStatus
+  @goModel(model: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatus") {
+  DRAFT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusDraft"
+    )
+  ACTIVE
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusActive"
+    )
+}
+
+input CreatePolicyInput {
+  organizationId: ID!
+  name: String!
+  content: String!
+  status: PolicyStatus!
+}
+
+input UpdatePolicyInput {
+  id: ID!
+  expectedVersion: Int!
+  name: String
+  content: String
+  status: PolicyStatus
+}
+
+input DeletePolicyInput {
+  policyId: ID!
+}
+
+type CreatePolicyPayload {
+  policyEdge: PolicyEdge!
+}
+
+type UpdatePolicyPayload {
+  policy: Policy!
+}
+
+type DeletePolicyPayload {
+  deletedPolicyId: ID!
+}
+
+type Policy implements Node {
+  id: ID!
+  version: Int!
+  name: String!
+  status: PolicyStatus!
+  content: String!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+type PolicyConnection {
+  edges: [PolicyEdge!]!
+  pageInfo: PageInfo!
+}
+
+type PolicyEdge {
+  cursor: CursorKey!
+  node: Policy!
+}
diff --git a/pkg/api/console/v1/schema/schema.go b/pkg/api/console/v1/schema/schema.go
index f0b01c648..6cd10bbc7 100644
--- a/pkg/api/console/v1/schema/schema.go
+++ b/pkg/api/console/v1/schema/schema.go
@@ -114,6 +114,10 @@ type ComplexityRoot struct {
 		PeopleEdge func(childComplexity int) int
 	}
 
+	CreatePolicyPayload struct {
+		PolicyEdge func(childComplexity int) int
+	}
+
 	CreateTaskPayload struct {
 		TaskEdge func(childComplexity int) int
 	}
@@ -134,6 +138,10 @@ type ComplexityRoot struct {
 		DeletedPeopleID func(childComplexity int) int
 	}
 
+	DeletePolicyPayload struct {
+		DeletedPolicyID func(childComplexity int) int
+	}
+
 	DeleteTaskPayload struct {
 		DeletedTaskID func(childComplexity int) int
 	}
@@ -208,16 +216,19 @@ type ComplexityRoot struct {
 		CreateFramework    func(childComplexity int, input types.CreateFrameworkInput) int
 		CreateOrganization func(childComplexity int, input types.CreateOrganizationInput) int
 		CreatePeople       func(childComplexity int, input types.CreatePeopleInput) int
+		CreatePolicy       func(childComplexity int, input types.CreatePolicyInput) int
 		CreateTask         func(childComplexity int, input types.CreateTaskInput) int
 		CreateVendor       func(childComplexity int, input types.CreateVendorInput) int
 		DeleteEvidence     func(childComplexity int, input types.DeleteEvidenceInput) int
 		DeleteOrganization func(childComplexity int, input types.DeleteOrganizationInput) int
 		DeletePeople       func(childComplexity int, input types.DeletePeopleInput) int
+		DeletePolicy       func(childComplexity int, input types.DeletePolicyInput) int
 		DeleteTask         func(childComplexity int, input types.DeleteTaskInput) int
 		DeleteVendor       func(childComplexity int, input types.DeleteVendorInput) int
 		UpdateControl      func(childComplexity int, input types.UpdateControlInput) int
 		UpdateFramework    func(childComplexity int, input types.UpdateFrameworkInput) int
 		UpdatePeople       func(childComplexity int, input types.UpdatePeopleInput) int
+		UpdatePolicy       func(childComplexity int, input types.UpdatePolicyInput) int
 		UpdateTaskState    func(childComplexity int, input types.UpdateTaskStateInput) int
 		UpdateVendor       func(childComplexity int, input types.UpdateVendorInput) int
 		UploadEvidence     func(childComplexity int, input types.UploadEvidenceInput) int
@@ -230,6 +241,7 @@ type ComplexityRoot struct {
 		LogoURL    func(childComplexity int) int
 		Name       func(childComplexity int) int
 		Peoples    func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
+		Policies   func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
 		UpdatedAt  func(childComplexity int) int
 		Vendors    func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
 	}
@@ -272,6 +284,26 @@ type ComplexityRoot struct {
 		Node   func(childComplexity int) int
 	}
 
+	Policy struct {
+		Content   func(childComplexity int) int
+		CreatedAt func(childComplexity int) int
+		ID        func(childComplexity int) int
+		Name      func(childComplexity int) int
+		Status    func(childComplexity int) int
+		UpdatedAt func(childComplexity int) int
+		Version   func(childComplexity int) int
+	}
+
+	PolicyConnection struct {
+		Edges    func(childComplexity int) int
+		PageInfo func(childComplexity int) int
+	}
+
+	PolicyEdge struct {
+		Cursor func(childComplexity int) int
+		Node   func(childComplexity int) int
+	}
+
 	Query struct {
 		Node   func(childComplexity int, id gid.GID) int
 		Viewer func(childComplexity int) int
@@ -334,6 +366,10 @@ type ComplexityRoot struct {
 		People func(childComplexity int) int
 	}
 
+	UpdatePolicyPayload struct {
+		Policy func(childComplexity int) int
+	}
+
 	UpdateTaskStatePayload struct {
 		Task func(childComplexity int) int
 	}
@@ -412,11 +448,15 @@ type MutationResolver interface {
 	UpdateControl(ctx context.Context, input types.UpdateControlInput) (*types.UpdateControlPayload, error)
 	UploadEvidence(ctx context.Context, input types.UploadEvidenceInput) (*types.UploadEvidencePayload, error)
 	DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error)
+	CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error)
+	UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error)
+	DeletePolicy(ctx context.Context, input types.DeletePolicyInput) (*types.DeletePolicyPayload, error)
 }
 type OrganizationResolver interface {
 	Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.FrameworkConnection, error)
 	Vendors(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.VendorConnection, error)
 	Peoples(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PeopleConnection, error)
+	Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PolicyConnection, error)
 }
 type QueryResolver interface {
 	Node(ctx context.Context, id gid.GID) (types.Node, error)
@@ -655,6 +695,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.CreatePeoplePayload.PeopleEdge(childComplexity), true
 
+	case "CreatePolicyPayload.policyEdge":
+		if e.complexity.CreatePolicyPayload.PolicyEdge == nil {
+			break
+		}
+
+		return e.complexity.CreatePolicyPayload.PolicyEdge(childComplexity), true
+
 	case "CreateTaskPayload.taskEdge":
 		if e.complexity.CreateTaskPayload.TaskEdge == nil {
 			break
@@ -690,6 +737,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.DeletePeoplePayload.DeletedPeopleID(childComplexity), true
 
+	case "DeletePolicyPayload.deletedPolicyId":
+		if e.complexity.DeletePolicyPayload.DeletedPolicyID == nil {
+			break
+		}
+
+		return e.complexity.DeletePolicyPayload.DeletedPolicyID(childComplexity), true
+
 	case "DeleteTaskPayload.deletedTaskId":
 		if e.complexity.DeleteTaskPayload.DeletedTaskID == nil {
 			break
@@ -1000,6 +1054,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Mutation.CreatePeople(childComplexity, args["input"].(types.CreatePeopleInput)), true
 
+	case "Mutation.createPolicy":
+		if e.complexity.Mutation.CreatePolicy == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_createPolicy_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.CreatePolicy(childComplexity, args["input"].(types.CreatePolicyInput)), true
+
 	case "Mutation.createTask":
 		if e.complexity.Mutation.CreateTask == nil {
 			break
@@ -1060,6 +1126,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Mutation.DeletePeople(childComplexity, args["input"].(types.DeletePeopleInput)), true
 
+	case "Mutation.deletePolicy":
+		if e.complexity.Mutation.DeletePolicy == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_deletePolicy_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.DeletePolicy(childComplexity, args["input"].(types.DeletePolicyInput)), true
+
 	case "Mutation.deleteTask":
 		if e.complexity.Mutation.DeleteTask == nil {
 			break
@@ -1120,6 +1198,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Mutation.UpdatePeople(childComplexity, args["input"].(types.UpdatePeopleInput)), true
 
+	case "Mutation.updatePolicy":
+		if e.complexity.Mutation.UpdatePolicy == nil {
+			break
+		}
+
+		args, err := ec.field_Mutation_updatePolicy_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Mutation.UpdatePolicy(childComplexity, args["input"].(types.UpdatePolicyInput)), true
+
 	case "Mutation.updateTaskState":
 		if e.complexity.Mutation.UpdateTaskState == nil {
 			break
@@ -1208,6 +1298,18 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.Organization.Peoples(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey)), true
 
+	case "Organization.policies":
+		if e.complexity.Organization.Policies == nil {
+			break
+		}
+
+		args, err := ec.field_Organization_policies_args(context.TODO(), rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.complexity.Organization.Policies(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey)), true
+
 	case "Organization.updatedAt":
 		if e.complexity.Organization.UpdatedAt == nil {
 			break
@@ -1367,6 +1469,83 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.PeopleEdge.Node(childComplexity), true
 
+	case "Policy.content":
+		if e.complexity.Policy.Content == nil {
+			break
+		}
+
+		return e.complexity.Policy.Content(childComplexity), true
+
+	case "Policy.createdAt":
+		if e.complexity.Policy.CreatedAt == nil {
+			break
+		}
+
+		return e.complexity.Policy.CreatedAt(childComplexity), true
+
+	case "Policy.id":
+		if e.complexity.Policy.ID == nil {
+			break
+		}
+
+		return e.complexity.Policy.ID(childComplexity), true
+
+	case "Policy.name":
+		if e.complexity.Policy.Name == nil {
+			break
+		}
+
+		return e.complexity.Policy.Name(childComplexity), true
+
+	case "Policy.status":
+		if e.complexity.Policy.Status == nil {
+			break
+		}
+
+		return e.complexity.Policy.Status(childComplexity), true
+
+	case "Policy.updatedAt":
+		if e.complexity.Policy.UpdatedAt == nil {
+			break
+		}
+
+		return e.complexity.Policy.UpdatedAt(childComplexity), true
+
+	case "Policy.version":
+		if e.complexity.Policy.Version == nil {
+			break
+		}
+
+		return e.complexity.Policy.Version(childComplexity), true
+
+	case "PolicyConnection.edges":
+		if e.complexity.PolicyConnection.Edges == nil {
+			break
+		}
+
+		return e.complexity.PolicyConnection.Edges(childComplexity), true
+
+	case "PolicyConnection.pageInfo":
+		if e.complexity.PolicyConnection.PageInfo == nil {
+			break
+		}
+
+		return e.complexity.PolicyConnection.PageInfo(childComplexity), true
+
+	case "PolicyEdge.cursor":
+		if e.complexity.PolicyEdge.Cursor == nil {
+			break
+		}
+
+		return e.complexity.PolicyEdge.Cursor(childComplexity), true
+
+	case "PolicyEdge.node":
+		if e.complexity.PolicyEdge.Node == nil {
+			break
+		}
+
+		return e.complexity.PolicyEdge.Node(childComplexity), true
+
 	case "Query.node":
 		if e.complexity.Query.Node == nil {
 			break
@@ -1585,6 +1764,13 @@ func (e *executableSchema) Complexity(typeName, field string, childComplexity in
 
 		return e.complexity.UpdatePeoplePayload.People(childComplexity), true
 
+	case "UpdatePolicyPayload.policy":
+		if e.complexity.UpdatePolicyPayload.Policy == nil {
+			break
+		}
+
+		return e.complexity.UpdatePolicyPayload.Policy(childComplexity), true
+
 	case "UpdateTaskStatePayload.task":
 		if e.complexity.UpdateTaskStatePayload.Task == nil {
 			break
@@ -1784,16 +1970,19 @@ func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {
 		ec.unmarshalInputCreateFrameworkInput,
 		ec.unmarshalInputCreateOrganizationInput,
 		ec.unmarshalInputCreatePeopleInput,
+		ec.unmarshalInputCreatePolicyInput,
 		ec.unmarshalInputCreateTaskInput,
 		ec.unmarshalInputCreateVendorInput,
 		ec.unmarshalInputDeleteEvidenceInput,
 		ec.unmarshalInputDeleteOrganizationInput,
 		ec.unmarshalInputDeletePeopleInput,
+		ec.unmarshalInputDeletePolicyInput,
 		ec.unmarshalInputDeleteTaskInput,
 		ec.unmarshalInputDeleteVendorInput,
 		ec.unmarshalInputUpdateControlInput,
 		ec.unmarshalInputUpdateFrameworkInput,
 		ec.unmarshalInputUpdatePeopleInput,
+		ec.unmarshalInputUpdatePolicyInput,
 		ec.unmarshalInputUpdateTaskStateInput,
 		ec.unmarshalInputUpdateVendorInput,
 		ec.unmarshalInputUploadEvidenceInput,
@@ -2017,6 +2206,13 @@ type Organization implements Node {
     before: CursorKey
   ): PeopleConnection! @goField(forceResolver: true)
 
+  policies(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): PolicyConnection! @goField(forceResolver: true)
+
   createdAt: Datetime!
   updatedAt: Datetime!
 }
@@ -2300,6 +2496,9 @@ type Mutation {
   updateControl(input: UpdateControlInput!): UpdateControlPayload!
   uploadEvidence(input: UploadEvidenceInput!): UploadEvidencePayload!
   deleteEvidence(input: DeleteEvidenceInput!): DeleteEvidencePayload!
+  createPolicy(input: CreatePolicyInput!): CreatePolicyPayload!
+  updatePolicy(input: UpdatePolicyInput!): UpdatePolicyPayload!
+  deletePolicy(input: DeletePolicyInput!): DeletePolicyPayload!
 }
 
 input CreateVendorInput {
@@ -2517,6 +2716,69 @@ input DeleteEvidenceInput {
 type DeleteEvidencePayload {
   deletedEvidenceId: ID!
 }
+
+enum PolicyStatus
+  @goModel(model: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatus") {
+  DRAFT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusDraft"
+    )
+  ACTIVE
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/probo/coredata.PolicyStatusActive"
+    )
+}
+
+input CreatePolicyInput {
+  organizationId: ID!
+  name: String!
+  content: String!
+  status: PolicyStatus!
+}
+
+input UpdatePolicyInput {
+  id: ID!
+  expectedVersion: Int!
+  name: String
+  content: String
+  status: PolicyStatus
+}
+
+input DeletePolicyInput {
+  policyId: ID!
+}
+
+type CreatePolicyPayload {
+  policyEdge: PolicyEdge!
+}
+
+type UpdatePolicyPayload {
+  policy: Policy!
+}
+
+type DeletePolicyPayload {
+  deletedPolicyId: ID!
+}
+
+type Policy implements Node {
+  id: ID!
+  version: Int!
+  name: String!
+  status: PolicyStatus!
+  content: String!
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+type PolicyConnection {
+  edges: [PolicyEdge!]!
+  pageInfo: PageInfo!
+}
+
+type PolicyEdge {
+  cursor: CursorKey!
+  node: Policy!
+}
 `, BuiltIn: false},
 }
 var parsedSchema = gqlparser.MustLoadSchema(sources...)
@@ -2925,6 +3187,29 @@ func (ec *executionContext) field_Mutation_createPeople_argsInput(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Mutation_createPolicy_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Mutation_createPolicy_argsInput(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field_Mutation_createPolicy_argsInput(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (types.CreatePolicyInput, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
+	if tmp, ok := rawArgs["input"]; ok {
+		return ec.unmarshalNCreatePolicyInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐCreatePolicyInput(ctx, tmp)
+	}
+
+	var zeroVal types.CreatePolicyInput
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Mutation_createTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -3040,6 +3325,29 @@ func (ec *executionContext) field_Mutation_deletePeople_argsInput(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Mutation_deletePolicy_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Mutation_deletePolicy_argsInput(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field_Mutation_deletePolicy_argsInput(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (types.DeletePolicyInput, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
+	if tmp, ok := rawArgs["input"]; ok {
+		return ec.unmarshalNDeletePolicyInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐDeletePolicyInput(ctx, tmp)
+	}
+
+	var zeroVal types.DeletePolicyInput
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Mutation_deleteTask_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -3155,6 +3463,29 @@ func (ec *executionContext) field_Mutation_updatePeople_argsInput(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Mutation_updatePolicy_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Mutation_updatePolicy_argsInput(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["input"] = arg0
+	return args, nil
+}
+func (ec *executionContext) field_Mutation_updatePolicy_argsInput(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (types.UpdatePolicyInput, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("input"))
+	if tmp, ok := rawArgs["input"]; ok {
+		return ec.unmarshalNUpdatePolicyInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdatePolicyInput(ctx, tmp)
+	}
+
+	var zeroVal types.UpdatePolicyInput
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Mutation_updateTaskState_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -3378,6 +3709,83 @@ func (ec *executionContext) field_Organization_peoples_argsBefore(
 	return zeroVal, nil
 }
 
+func (ec *executionContext) field_Organization_policies_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := ec.field_Organization_policies_argsFirst(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := ec.field_Organization_policies_argsAfter(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := ec.field_Organization_policies_argsLast(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := ec.field_Organization_policies_argsBefore(ctx, rawArgs)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	return args, nil
+}
+func (ec *executionContext) field_Organization_policies_argsFirst(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*int, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("first"))
+	if tmp, ok := rawArgs["first"]; ok {
+		return ec.unmarshalOInt2ᚖint(ctx, tmp)
+	}
+
+	var zeroVal *int
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field_Organization_policies_argsAfter(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*page.CursorKey, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("after"))
+	if tmp, ok := rawArgs["after"]; ok {
+		return ec.unmarshalOCursorKey2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, tmp)
+	}
+
+	var zeroVal *page.CursorKey
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field_Organization_policies_argsLast(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*int, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("last"))
+	if tmp, ok := rawArgs["last"]; ok {
+		return ec.unmarshalOInt2ᚖint(ctx, tmp)
+	}
+
+	var zeroVal *int
+	return zeroVal, nil
+}
+
+func (ec *executionContext) field_Organization_policies_argsBefore(
+	ctx context.Context,
+	rawArgs map[string]any,
+) (*page.CursorKey, error) {
+	ctx = graphql.WithPathContext(ctx, graphql.NewPathWithField("before"))
+	if tmp, ok := rawArgs["before"]; ok {
+		return ec.unmarshalOCursorKey2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, tmp)
+	}
+
+	var zeroVal *page.CursorKey
+	return zeroVal, nil
+}
+
 func (ec *executionContext) field_Organization_vendors_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -4958,6 +5366,50 @@ func (ec *executionContext) fieldContext_CreatePeoplePayload_peopleEdge(_ contex
 	return fc, nil
 }
 
+func (ec *executionContext) _CreatePolicyPayload_policyEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreatePolicyPayload) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_CreatePolicyPayload_policyEdge(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.PolicyEdge, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.PolicyEdge)
+	fc.Result = res
+	return ec.marshalNPolicyEdge2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyEdge(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_CreatePolicyPayload_policyEdge(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "CreatePolicyPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_PolicyEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_PolicyEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PolicyEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _CreateTaskPayload_taskEdge(ctx context.Context, field graphql.CollectedField, obj *types.CreateTaskPayload) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_CreateTaskPayload_taskEdge(ctx, field)
 	if err != nil {
@@ -5160,6 +5612,44 @@ func (ec *executionContext) fieldContext_DeletePeoplePayload_deletedPeopleId(_ c
 	return fc, nil
 }
 
+func (ec *executionContext) _DeletePolicyPayload_deletedPolicyId(ctx context.Context, field graphql.CollectedField, obj *types.DeletePolicyPayload) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_DeletePolicyPayload_deletedPolicyId(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.DeletedPolicyID, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(gid.GID)
+	fc.Result = res
+	return ec.marshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_DeletePolicyPayload_deletedPolicyId(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "DeletePolicyPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _DeleteTaskPayload_deletedTaskId(ctx context.Context, field graphql.CollectedField, obj *types.DeleteTaskPayload) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_DeleteTaskPayload_deletedTaskId(ctx, field)
 	if err != nil {
@@ -7441,6 +7931,147 @@ func (ec *executionContext) fieldContext_Mutation_deleteEvidence(ctx context.Con
 	return fc, nil
 }
 
+func (ec *executionContext) _Mutation_createPolicy(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Mutation_createPolicy(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Mutation().CreatePolicy(rctx, fc.Args["input"].(types.CreatePolicyInput))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.CreatePolicyPayload)
+	fc.Result = res
+	return ec.marshalNCreatePolicyPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐCreatePolicyPayload(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Mutation_createPolicy(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "policyEdge":
+				return ec.fieldContext_CreatePolicyPayload_policyEdge(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type CreatePolicyPayload", field.Name)
+		},
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_createPolicy_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_updatePolicy(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Mutation_updatePolicy(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Mutation().UpdatePolicy(rctx, fc.Args["input"].(types.UpdatePolicyInput))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.UpdatePolicyPayload)
+	fc.Result = res
+	return ec.marshalNUpdatePolicyPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdatePolicyPayload(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Mutation_updatePolicy(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "policy":
+				return ec.fieldContext_UpdatePolicyPayload_policy(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type UpdatePolicyPayload", field.Name)
+		},
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_updatePolicy_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Mutation_deletePolicy(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Mutation_deletePolicy(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Mutation().DeletePolicy(rctx, fc.Args["input"].(types.DeletePolicyInput))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.DeletePolicyPayload)
+	fc.Result = res
+	return ec.marshalNDeletePolicyPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐDeletePolicyPayload(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Mutation_deletePolicy(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Mutation",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "deletedPolicyId":
+				return ec.fieldContext_DeletePolicyPayload_deletedPolicyId(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type DeletePolicyPayload", field.Name)
+		},
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Mutation_deletePolicy_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Organization_id(ctx context.Context, field graphql.CollectedField, obj *types.Organization) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Organization_id(ctx, field)
 	if err != nil {
@@ -7702,6 +8333,55 @@ func (ec *executionContext) fieldContext_Organization_peoples(ctx context.Contex
 	return fc, nil
 }
 
+func (ec *executionContext) _Organization_policies(ctx context.Context, field graphql.CollectedField, obj *types.Organization) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Organization_policies(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return ec.resolvers.Organization().Policies(rctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey))
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.PolicyConnection)
+	fc.Result = res
+	return ec.marshalNPolicyConnection2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyConnection(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Organization_policies(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Organization",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "edges":
+				return ec.fieldContext_PolicyConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_PolicyConnection_pageInfo(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PolicyConnection", field.Name)
+		},
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_Organization_policies_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Organization_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Organization) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Organization_createdAt(ctx, field)
 	if err != nil {
@@ -7953,6 +8633,8 @@ func (ec *executionContext) fieldContext_OrganizationEdge_node(_ context.Context
 				return ec.fieldContext_Organization_vendors(ctx, field)
 			case "peoples":
 				return ec.fieldContext_Organization_peoples(ctx, field)
+			case "policies":
+				return ec.fieldContext_Organization_policies(ctx, field)
 			case "createdAt":
 				return ec.fieldContext_Organization_createdAt(ctx, field)
 			case "updatedAt":
@@ -8600,6 +9282,456 @@ func (ec *executionContext) fieldContext_PeopleEdge_node(_ context.Context, fiel
 	return fc, nil
 }
 
+func (ec *executionContext) _Policy_id(ctx context.Context, field graphql.CollectedField, obj *types.Policy) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Policy_id(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.ID, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(gid.GID)
+	fc.Result = res
+	return ec.marshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Policy_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Policy",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Policy_version(ctx context.Context, field graphql.CollectedField, obj *types.Policy) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Policy_version(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Version, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(int)
+	fc.Result = res
+	return ec.marshalNInt2int(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Policy_version(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Policy",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Int does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Policy_name(ctx context.Context, field graphql.CollectedField, obj *types.Policy) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Policy_name(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Name, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Policy_name(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Policy",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Policy_status(ctx context.Context, field graphql.CollectedField, obj *types.Policy) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Policy_status(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Status, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(coredata.PolicyStatus)
+	fc.Result = res
+	return ec.marshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Policy_status(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Policy",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type PolicyStatus does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Policy_content(ctx context.Context, field graphql.CollectedField, obj *types.Policy) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Policy_content(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Content, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(string)
+	fc.Result = res
+	return ec.marshalNString2string(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Policy_content(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Policy",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Policy_createdAt(ctx context.Context, field graphql.CollectedField, obj *types.Policy) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Policy_createdAt(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.CreatedAt, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(time.Time)
+	fc.Result = res
+	return ec.marshalNDatetime2timeᚐTime(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Policy_createdAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Policy",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Policy_updatedAt(ctx context.Context, field graphql.CollectedField, obj *types.Policy) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Policy_updatedAt(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.UpdatedAt, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(time.Time)
+	fc.Result = res
+	return ec.marshalNDatetime2timeᚐTime(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Policy_updatedAt(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Policy",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Datetime does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _PolicyConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.PolicyConnection) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PolicyConnection_edges(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Edges, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.([]*types.PolicyEdge)
+	fc.Result = res
+	return ec.marshalNPolicyEdge2ᚕᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyEdgeᚄ(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_PolicyConnection_edges(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "PolicyConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_PolicyEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_PolicyEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PolicyEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _PolicyConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *types.PolicyConnection) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PolicyConnection_pageInfo(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.PageInfo, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.PageInfo)
+	fc.Result = res
+	return ec.marshalNPageInfo2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPageInfo(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_PolicyConnection_pageInfo(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "PolicyConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "hasNextPage":
+				return ec.fieldContext_PageInfo_hasNextPage(ctx, field)
+			case "hasPreviousPage":
+				return ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
+			case "startCursor":
+				return ec.fieldContext_PageInfo_startCursor(ctx, field)
+			case "endCursor":
+				return ec.fieldContext_PageInfo_endCursor(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PageInfo", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _PolicyEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *types.PolicyEdge) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PolicyEdge_cursor(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Cursor, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(page.CursorKey)
+	fc.Result = res
+	return ec.marshalNCursorKey2githubᚗcomᚋgetproboᚋproboᚋpkgᚋpageᚐCursorKey(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_PolicyEdge_cursor(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "PolicyEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type CursorKey does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _PolicyEdge_node(ctx context.Context, field graphql.CollectedField, obj *types.PolicyEdge) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_PolicyEdge_node(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Node, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.Policy)
+	fc.Result = res
+	return ec.marshalNPolicy2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicy(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_PolicyEdge_node(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "PolicyEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Policy_id(ctx, field)
+			case "version":
+				return ec.fieldContext_Policy_version(ctx, field)
+			case "name":
+				return ec.fieldContext_Policy_name(ctx, field)
+			case "status":
+				return ec.fieldContext_Policy_status(ctx, field)
+			case "content":
+				return ec.fieldContext_Policy_content(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Policy_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_Policy_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Policy", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Query_node(ctx context.Context, field graphql.CollectedField) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Query_node(ctx, field)
 	if err != nil {
@@ -9968,6 +11100,60 @@ func (ec *executionContext) fieldContext_UpdatePeoplePayload_people(_ context.Co
 	return fc, nil
 }
 
+func (ec *executionContext) _UpdatePolicyPayload_policy(ctx context.Context, field graphql.CollectedField, obj *types.UpdatePolicyPayload) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_UpdatePolicyPayload_policy(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.Policy, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		if !graphql.HasFieldError(ctx, fc) {
+			ec.Errorf(ctx, "must not be null")
+		}
+		return graphql.Null
+	}
+	res := resTmp.(*types.Policy)
+	fc.Result = res
+	return ec.marshalNPolicy2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicy(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_UpdatePolicyPayload_policy(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "UpdatePolicyPayload",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_Policy_id(ctx, field)
+			case "version":
+				return ec.fieldContext_Policy_version(ctx, field)
+			case "name":
+				return ec.fieldContext_Policy_name(ctx, field)
+			case "status":
+				return ec.fieldContext_Policy_status(ctx, field)
+			case "content":
+				return ec.fieldContext_Policy_content(ctx, field)
+			case "createdAt":
+				return ec.fieldContext_Policy_createdAt(ctx, field)
+			case "updatedAt":
+				return ec.fieldContext_Policy_updatedAt(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type Policy", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _UpdateTaskStatePayload_task(ctx context.Context, field graphql.CollectedField, obj *types.UpdateTaskStatePayload) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_UpdateTaskStatePayload_task(ctx, field)
 	if err != nil {
@@ -12773,6 +13959,54 @@ func (ec *executionContext) unmarshalInputCreatePeopleInput(ctx context.Context,
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputCreatePolicyInput(ctx context.Context, obj any) (types.CreatePolicyInput, error) {
+	var it types.CreatePolicyInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"organizationId", "name", "content", "status"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "organizationId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("organizationId"))
+			data, err := ec.unmarshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.OrganizationID = data
+		case "name":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Name = data
+		case "content":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("content"))
+			data, err := ec.unmarshalNString2string(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Content = data
+		case "status":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("status"))
+			data, err := ec.unmarshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Status = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputCreateTaskInput(ctx context.Context, obj any) (types.CreateTaskInput, error) {
 	var it types.CreateTaskInput
 	asMap := map[string]any{}
@@ -12985,6 +14219,33 @@ func (ec *executionContext) unmarshalInputDeletePeopleInput(ctx context.Context,
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputDeletePolicyInput(ctx context.Context, obj any) (types.DeletePolicyInput, error) {
+	var it types.DeletePolicyInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"policyId"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "policyId":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("policyId"))
+			data, err := ec.unmarshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.PolicyID = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputDeleteTaskInput(ctx context.Context, obj any) (types.DeleteTaskInput, error) {
 	var it types.DeleteTaskInput
 	asMap := map[string]any{}
@@ -13211,6 +14472,61 @@ func (ec *executionContext) unmarshalInputUpdatePeopleInput(ctx context.Context,
 	return it, nil
 }
 
+func (ec *executionContext) unmarshalInputUpdatePolicyInput(ctx context.Context, obj any) (types.UpdatePolicyInput, error) {
+	var it types.UpdatePolicyInput
+	asMap := map[string]any{}
+	for k, v := range obj.(map[string]any) {
+		asMap[k] = v
+	}
+
+	fieldsInOrder := [...]string{"id", "expectedVersion", "name", "content", "status"}
+	for _, k := range fieldsInOrder {
+		v, ok := asMap[k]
+		if !ok {
+			continue
+		}
+		switch k {
+		case "id":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("id"))
+			data, err := ec.unmarshalNID2githubᚗcomᚋgetproboᚋproboᚋpkgᚋgidᚐGID(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ID = data
+		case "expectedVersion":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("expectedVersion"))
+			data, err := ec.unmarshalNInt2int(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.ExpectedVersion = data
+		case "name":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("name"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Name = data
+		case "content":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("content"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Content = data
+		case "status":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("status"))
+			data, err := ec.unmarshalOPolicyStatus2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.Status = data
+		}
+	}
+
+	return it, nil
+}
+
 func (ec *executionContext) unmarshalInputUpdateTaskStateInput(ctx context.Context, obj any) (types.UpdateTaskStateInput, error) {
 	var it types.UpdateTaskStateInput
 	asMap := map[string]any{}
@@ -13447,6 +14763,13 @@ func (ec *executionContext) _Node(ctx context.Context, sel ast.SelectionSet, obj
 			return graphql.Null
 		}
 		return ec._User(ctx, sel, obj)
+	case types.Policy:
+		return ec._Policy(ctx, sel, &obj)
+	case *types.Policy:
+		if obj == nil {
+			return graphql.Null
+		}
+		return ec._Policy(ctx, sel, obj)
 	default:
 		panic(fmt.Errorf("unexpected type %T", obj))
 	}
@@ -13982,6 +15305,45 @@ func (ec *executionContext) _CreatePeoplePayload(ctx context.Context, sel ast.Se
 	return out
 }
 
+var createPolicyPayloadImplementors = []string{"CreatePolicyPayload"}
+
+func (ec *executionContext) _CreatePolicyPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreatePolicyPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, createPolicyPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("CreatePolicyPayload")
+		case "policyEdge":
+			out.Values[i] = ec._CreatePolicyPayload_policyEdge(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var createTaskPayloadImplementors = []string{"CreateTaskPayload"}
 
 func (ec *executionContext) _CreateTaskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.CreateTaskPayload) graphql.Marshaler {
@@ -14177,6 +15539,45 @@ func (ec *executionContext) _DeletePeoplePayload(ctx context.Context, sel ast.Se
 	return out
 }
 
+var deletePolicyPayloadImplementors = []string{"DeletePolicyPayload"}
+
+func (ec *executionContext) _DeletePolicyPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeletePolicyPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, deletePolicyPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("DeletePolicyPayload")
+		case "deletedPolicyId":
+			out.Values[i] = ec._DeletePolicyPayload_deletedPolicyId(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var deleteTaskPayloadImplementors = []string{"DeleteTaskPayload"}
 
 func (ec *executionContext) _DeleteTaskPayload(ctx context.Context, sel ast.SelectionSet, obj *types.DeleteTaskPayload) graphql.Marshaler {
@@ -14941,6 +16342,27 @@ func (ec *executionContext) _Mutation(ctx context.Context, sel ast.SelectionSet)
 			if out.Values[i] == graphql.Null {
 				out.Invalids++
 			}
+		case "createPolicy":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_createPolicy(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "updatePolicy":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_updatePolicy(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "deletePolicy":
+			out.Values[i] = ec.OperationContext.RootResolverMiddleware(innerCtx, func(ctx context.Context) (res graphql.Marshaler) {
+				return ec._Mutation_deletePolicy(ctx, field)
+			})
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
 		}
@@ -15082,6 +16504,37 @@ func (ec *executionContext) _Organization(ctx context.Context, sel ast.Selection
 				continue
 			}
 
+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "policies":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				res = ec._Organization_policies(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		case "createdAt":
 			out.Values[i] = ec._Organization_createdAt(ctx, field, obj)
@@ -15414,6 +16867,163 @@ func (ec *executionContext) _PeopleEdge(ctx context.Context, sel ast.SelectionSe
 	return out
 }
 
+var policyImplementors = []string{"Policy", "Node"}
+
+func (ec *executionContext) _Policy(ctx context.Context, sel ast.SelectionSet, obj *types.Policy) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, policyImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("Policy")
+		case "id":
+			out.Values[i] = ec._Policy_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "version":
+			out.Values[i] = ec._Policy_version(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "name":
+			out.Values[i] = ec._Policy_name(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "status":
+			out.Values[i] = ec._Policy_status(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "content":
+			out.Values[i] = ec._Policy_content(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "createdAt":
+			out.Values[i] = ec._Policy_createdAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "updatedAt":
+			out.Values[i] = ec._Policy_updatedAt(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var policyConnectionImplementors = []string{"PolicyConnection"}
+
+func (ec *executionContext) _PolicyConnection(ctx context.Context, sel ast.SelectionSet, obj *types.PolicyConnection) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, policyConnectionImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("PolicyConnection")
+		case "edges":
+			out.Values[i] = ec._PolicyConnection_edges(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "pageInfo":
+			out.Values[i] = ec._PolicyConnection_pageInfo(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var policyEdgeImplementors = []string{"PolicyEdge"}
+
+func (ec *executionContext) _PolicyEdge(ctx context.Context, sel ast.SelectionSet, obj *types.PolicyEdge) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, policyEdgeImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("PolicyEdge")
+		case "cursor":
+			out.Values[i] = ec._PolicyEdge_cursor(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "node":
+			out.Values[i] = ec._PolicyEdge_node(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var queryImplementors = []string{"Query"}
 
 func (ec *executionContext) _Query(ctx context.Context, sel ast.SelectionSet) graphql.Marshaler {
@@ -16019,6 +17629,45 @@ func (ec *executionContext) _UpdatePeoplePayload(ctx context.Context, sel ast.Se
 	return out
 }
 
+var updatePolicyPayloadImplementors = []string{"UpdatePolicyPayload"}
+
+func (ec *executionContext) _UpdatePolicyPayload(ctx context.Context, sel ast.SelectionSet, obj *types.UpdatePolicyPayload) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, updatePolicyPayloadImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("UpdatePolicyPayload")
+		case "policy":
+			out.Values[i] = ec._UpdatePolicyPayload_policy(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.processDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var updateTaskStatePayloadImplementors = []string{"UpdateTaskStatePayload"}
 
 func (ec *executionContext) _UpdateTaskStatePayload(ctx context.Context, sel ast.SelectionSet, obj *types.UpdateTaskStatePayload) graphql.Marshaler {
@@ -16993,6 +18642,25 @@ func (ec *executionContext) marshalNCreatePeoplePayload2ᚖgithubᚗcomᚋgetpro
 	return ec._CreatePeoplePayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNCreatePolicyInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐCreatePolicyInput(ctx context.Context, v any) (types.CreatePolicyInput, error) {
+	res, err := ec.unmarshalInputCreatePolicyInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNCreatePolicyPayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐCreatePolicyPayload(ctx context.Context, sel ast.SelectionSet, v types.CreatePolicyPayload) graphql.Marshaler {
+	return ec._CreatePolicyPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNCreatePolicyPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐCreatePolicyPayload(ctx context.Context, sel ast.SelectionSet, v *types.CreatePolicyPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._CreatePolicyPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNCreateTaskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐCreateTaskInput(ctx context.Context, v any) (types.CreateTaskInput, error) {
 	res, err := ec.unmarshalInputCreateTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -17118,6 +18786,25 @@ func (ec *executionContext) marshalNDeletePeoplePayload2ᚖgithubᚗcomᚋgetpro
 	return ec._DeletePeoplePayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNDeletePolicyInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐDeletePolicyInput(ctx context.Context, v any) (types.DeletePolicyInput, error) {
+	res, err := ec.unmarshalInputDeletePolicyInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNDeletePolicyPayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐDeletePolicyPayload(ctx context.Context, sel ast.SelectionSet, v types.DeletePolicyPayload) graphql.Marshaler {
+	return ec._DeletePolicyPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNDeletePolicyPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐDeletePolicyPayload(ctx context.Context, sel ast.SelectionSet, v *types.DeletePolicyPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._DeletePolicyPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNDeleteTaskInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐDeleteTaskInput(ctx context.Context, v any) (types.DeleteTaskInput, error) {
 	res, err := ec.unmarshalInputDeleteTaskInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -17622,6 +19309,105 @@ var (
 	}
 )
 
+func (ec *executionContext) marshalNPolicy2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicy(ctx context.Context, sel ast.SelectionSet, v *types.Policy) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._Policy(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNPolicyConnection2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyConnection(ctx context.Context, sel ast.SelectionSet, v types.PolicyConnection) graphql.Marshaler {
+	return ec._PolicyConnection(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNPolicyConnection2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyConnection(ctx context.Context, sel ast.SelectionSet, v *types.PolicyConnection) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._PolicyConnection(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNPolicyEdge2ᚕᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyEdgeᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.PolicyEdge) graphql.Marshaler {
+	ret := make(graphql.Array, len(v))
+	var wg sync.WaitGroup
+	isLen1 := len(v) == 1
+	if !isLen1 {
+		wg.Add(len(v))
+	}
+	for i := range v {
+		i := i
+		fc := &graphql.FieldContext{
+			Index:  &i,
+			Result: &v[i],
+		}
+		ctx := graphql.WithFieldContext(ctx, fc)
+		f := func(i int) {
+			if !isLen1 {
+				defer wg.Done()
+			}
+			ret[i] = ec.marshalNPolicyEdge2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyEdge(ctx, sel, v[i])
+		}
+		if isLen1 {
+			f(i)
+		} else {
+			go f(i)
+		}
+
+	}
+	wg.Wait()
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
+func (ec *executionContext) marshalNPolicyEdge2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐPolicyEdge(ctx context.Context, sel ast.SelectionSet, v *types.PolicyEdge) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._PolicyEdge(ctx, sel, v)
+}
+
+func (ec *executionContext) unmarshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus(ctx context.Context, v any) (coredata.PolicyStatus, error) {
+	tmp, err := graphql.UnmarshalString(v)
+	res := unmarshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus[tmp]
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus(ctx context.Context, sel ast.SelectionSet, v coredata.PolicyStatus) graphql.Marshaler {
+	res := graphql.MarshalString(marshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus[v])
+	if res == graphql.Null {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+	}
+	return res
+}
+
+var (
+	unmarshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus = map[string]coredata.PolicyStatus{
+		"DRAFT":  coredata.PolicyStatusDraft,
+		"ACTIVE": coredata.PolicyStatusActive,
+	}
+	marshalNPolicyStatus2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus = map[coredata.PolicyStatus]string{
+		coredata.PolicyStatusDraft:  "DRAFT",
+		coredata.PolicyStatusActive: "ACTIVE",
+	}
+)
+
 func (ec *executionContext) unmarshalNRiskTier2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐRiskTier(ctx context.Context, v any) (coredata.RiskTier, error) {
 	tmp, err := graphql.UnmarshalString(v)
 	res := unmarshalNRiskTier2githubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐRiskTier[tmp]
@@ -17955,6 +19741,25 @@ func (ec *executionContext) marshalNUpdatePeoplePayload2ᚖgithubᚗcomᚋgetpro
 	return ec._UpdatePeoplePayload(ctx, sel, v)
 }
 
+func (ec *executionContext) unmarshalNUpdatePolicyInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdatePolicyInput(ctx context.Context, v any) (types.UpdatePolicyInput, error) {
+	res, err := ec.unmarshalInputUpdatePolicyInput(ctx, v)
+	return res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalNUpdatePolicyPayload2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdatePolicyPayload(ctx context.Context, sel ast.SelectionSet, v types.UpdatePolicyPayload) graphql.Marshaler {
+	return ec._UpdatePolicyPayload(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNUpdatePolicyPayload2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdatePolicyPayload(ctx context.Context, sel ast.SelectionSet, v *types.UpdatePolicyPayload) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			ec.Errorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._UpdatePolicyPayload(ctx, sel, v)
+}
+
 func (ec *executionContext) unmarshalNUpdateTaskStateInput2githubᚗcomᚋgetproboᚋproboᚋpkgᚋapiᚋconsoleᚋv1ᚋtypesᚐUpdateTaskStateInput(ctx context.Context, v any) (types.UpdateTaskStateInput, error) {
 	res, err := ec.unmarshalInputUpdateTaskStateInput(ctx, v)
 	return res, graphql.ErrorOnPath(ctx, err)
@@ -18506,6 +20311,34 @@ var (
 	}
 )
 
+func (ec *executionContext) unmarshalOPolicyStatus2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus(ctx context.Context, v any) (*coredata.PolicyStatus, error) {
+	if v == nil {
+		return nil, nil
+	}
+	tmp, err := graphql.UnmarshalString(v)
+	res := unmarshalOPolicyStatus2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus[tmp]
+	return &res, graphql.ErrorOnPath(ctx, err)
+}
+
+func (ec *executionContext) marshalOPolicyStatus2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus(ctx context.Context, sel ast.SelectionSet, v *coredata.PolicyStatus) graphql.Marshaler {
+	if v == nil {
+		return graphql.Null
+	}
+	res := graphql.MarshalString(marshalOPolicyStatus2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus[*v])
+	return res
+}
+
+var (
+	unmarshalOPolicyStatus2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus = map[string]coredata.PolicyStatus{
+		"DRAFT":  coredata.PolicyStatusDraft,
+		"ACTIVE": coredata.PolicyStatusActive,
+	}
+	marshalOPolicyStatus2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐPolicyStatus = map[coredata.PolicyStatus]string{
+		coredata.PolicyStatusDraft:  "DRAFT",
+		coredata.PolicyStatusActive: "ACTIVE",
+	}
+)
+
 func (ec *executionContext) unmarshalORiskTier2ᚖgithubᚗcomᚋgetproboᚋproboᚋpkgᚋproboᚋcoredataᚐRiskTier(ctx context.Context, v any) (*coredata.RiskTier, error) {
 	if v == nil {
 		return nil, nil
diff --git a/pkg/api/console/v1/types/policy.go b/pkg/api/console/v1/types/policy.go
new file mode 100644
index 000000000..cedc74841
--- /dev/null
+++ b/pkg/api/console/v1/types/policy.go
@@ -0,0 +1,51 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/getprobo/probo/pkg/probo/coredata"
+)
+
+func NewPolicy(policy *coredata.Policy) *Policy {
+	return &Policy{
+		ID:        policy.ID,
+		Version:   policy.Version,
+		Name:      policy.Name,
+		Content:   policy.Content,
+		CreatedAt: policy.CreatedAt,
+		UpdatedAt: policy.UpdatedAt,
+		Status:    policy.Status,
+	}
+}
+
+func NewPolicyEdge(policy *coredata.Policy) *PolicyEdge {
+	return &PolicyEdge{
+		Cursor: policy.CursorKey(),
+		Node:   NewPolicy(policy),
+	}
+}
+
+func NewPolicyConnection(page *page.Page[*coredata.Policy]) *PolicyConnection {
+	edges := make([]*PolicyEdge, len(page.Data))
+	for i, policy := range page.Data {
+		edges[i] = NewPolicyEdge(policy)
+	}
+
+	return &PolicyConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(page),
+	}
+}
diff --git a/pkg/api/console/v1/types/types.go b/pkg/api/console/v1/types/types.go
index a9f9369ff..75f53c898 100644
--- a/pkg/api/console/v1/types/types.go
+++ b/pkg/api/console/v1/types/types.go
@@ -102,6 +102,17 @@ type CreatePeoplePayload struct {
 	PeopleEdge *PeopleEdge `json:"peopleEdge"`
 }
 
+type CreatePolicyInput struct {
+	OrganizationID gid.GID               `json:"organizationId"`
+	Name           string                `json:"name"`
+	Content        string                `json:"content"`
+	Status         coredata.PolicyStatus `json:"status"`
+}
+
+type CreatePolicyPayload struct {
+	PolicyEdge *PolicyEdge `json:"policyEdge"`
+}
+
 type CreateTaskInput struct {
 	ControlID   gid.GID `json:"controlId"`
 	Name        string  `json:"name"`
@@ -153,6 +164,14 @@ type DeletePeoplePayload struct {
 	DeletedPeopleID gid.GID `json:"deletedPeopleId"`
 }
 
+type DeletePolicyInput struct {
+	PolicyID gid.GID `json:"policyId"`
+}
+
+type DeletePolicyPayload struct {
+	DeletedPolicyID gid.GID `json:"deletedPolicyId"`
+}
+
 type DeleteTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -246,6 +265,7 @@ type Organization struct {
 	Frameworks *FrameworkConnection `json:"frameworks"`
 	Vendors    *VendorConnection    `json:"vendors"`
 	Peoples    *PeopleConnection    `json:"peoples"`
+	Policies   *PolicyConnection    `json:"policies"`
 	CreatedAt  time.Time            `json:"createdAt"`
 	UpdatedAt  time.Time            `json:"updatedAt"`
 }
@@ -294,6 +314,29 @@ type PeopleEdge struct {
 	Node   *People        `json:"node"`
 }
 
+type Policy struct {
+	ID        gid.GID               `json:"id"`
+	Version   int                   `json:"version"`
+	Name      string                `json:"name"`
+	Status    coredata.PolicyStatus `json:"status"`
+	Content   string                `json:"content"`
+	CreatedAt time.Time             `json:"createdAt"`
+	UpdatedAt time.Time             `json:"updatedAt"`
+}
+
+func (Policy) IsNode()             {}
+func (this Policy) GetID() gid.GID { return this.ID }
+
+type PolicyConnection struct {
+	Edges    []*PolicyEdge `json:"edges"`
+	PageInfo *PageInfo     `json:"pageInfo"`
+}
+
+type PolicyEdge struct {
+	Cursor page.CursorKey `json:"cursor"`
+	Node   *Policy        `json:"node"`
+}
+
 type Query struct {
 }
 
@@ -382,6 +425,18 @@ type UpdatePeoplePayload struct {
 	People *People `json:"people"`
 }
 
+type UpdatePolicyInput struct {
+	ID              gid.GID                `json:"id"`
+	ExpectedVersion int                    `json:"expectedVersion"`
+	Name            *string                `json:"name,omitempty"`
+	Content         *string                `json:"content,omitempty"`
+	Status          *coredata.PolicyStatus `json:"status,omitempty"`
+}
+
+type UpdatePolicyPayload struct {
+	Policy *Policy `json:"policy"`
+}
+
 type UpdateTaskStateInput struct {
 	TaskID gid.GID            `json:"taskId"`
 	State  coredata.TaskState `json:"state"`
diff --git a/pkg/api/console/v1/v1_resolver.go b/pkg/api/console/v1/v1_resolver.go
index 750f1b0f6..2c15467f6 100644
--- a/pkg/api/console/v1/v1_resolver.go
+++ b/pkg/api/console/v1/v1_resolver.go
@@ -375,6 +375,53 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 	}, nil
 }
 
+// CreatePolicy is the resolver for the createPolicy field.
+func (r *mutationResolver) CreatePolicy(ctx context.Context, input types.CreatePolicyInput) (*types.CreatePolicyPayload, error) {
+	policy, err := r.proboSvc.Policies.Create(ctx, probo.CreatePolicyRequest{
+		OrganizationID: input.OrganizationID,
+		Name:           input.Name,
+		Content:        input.Content,
+		Status:         input.Status,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot create policy: %w", err)
+	}
+
+	return &types.CreatePolicyPayload{
+		PolicyEdge: types.NewPolicyEdge(policy),
+	}, nil
+}
+
+// UpdatePolicy is the resolver for the updatePolicy field.
+func (r *mutationResolver) UpdatePolicy(ctx context.Context, input types.UpdatePolicyInput) (*types.UpdatePolicyPayload, error) {
+	policy, err := r.proboSvc.Policies.Update(ctx, probo.UpdatePolicyRequest{
+		ID:              input.ID,
+		ExpectedVersion: input.ExpectedVersion,
+		Name:            input.Name,
+		Content:         input.Content,
+		Status:          input.Status,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot update policy: %w", err)
+	}
+
+	return &types.UpdatePolicyPayload{
+		Policy: types.NewPolicy(policy),
+	}, nil
+}
+
+// DeletePolicy is the resolver for the deletePolicy field.
+func (r *mutationResolver) DeletePolicy(ctx context.Context, input types.DeletePolicyInput) (*types.DeletePolicyPayload, error) {
+	err := r.proboSvc.Policies.Delete(ctx, input.PolicyID)
+	if err != nil {
+		return nil, fmt.Errorf("cannot delete policy: %w", err)
+	}
+
+	return &types.DeletePolicyPayload{
+		DeletedPolicyID: input.PolicyID,
+	}, nil
+}
+
 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.FrameworkConnection, error) {
 	cursor := types.NewCursor(first, after, last, before)
@@ -411,6 +458,18 @@ func (r *organizationResolver) Peoples(ctx context.Context, obj *types.Organizat
 	return types.NewPeopleConnection(page), nil
 }
 
+// Policies is the resolver for the policies field.
+func (r *organizationResolver) Policies(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PolicyConnection, error) {
+	cursor := types.NewCursor(first, after, last, before)
+
+	page, err := r.proboSvc.Policies.ListByOrganization(ctx, obj.ID, cursor)
+	if err != nil {
+		return nil, fmt.Errorf("cannot list organization policies: %w", err)
+	}
+
+	return types.NewPolicyConnection(page), nil
+}
+
 // Node is the resolver for the node field.
 func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error) {
 	switch id.EntityType() {
@@ -463,6 +522,12 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 
 		return types.NewEvidence(evidence), nil
+	case coredata.PolicyEntityType:
+		policy, err := r.proboSvc.Policies.Get(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		return types.NewPolicy(policy), nil
 	default:
 	}
 
diff --git a/pkg/probo/coredata/entity_type_reg.go b/pkg/probo/coredata/entity_type_reg.go
index 3dc0e0528..b88c691c4 100644
--- a/pkg/probo/coredata/entity_type_reg.go
+++ b/pkg/probo/coredata/entity_type_reg.go
@@ -25,4 +25,5 @@ const (
 	VendorEntityType
 	PeopleEntityType
 	EvidenceStateTransitionEntityType
+	PolicyEntityType
 )
diff --git a/pkg/probo/coredata/migrations/20250228T000000Z.sql b/pkg/probo/coredata/migrations/20250228T000000Z.sql
new file mode 100644
index 000000000..1b4ba006c
--- /dev/null
+++ b/pkg/probo/coredata/migrations/20250228T000000Z.sql
@@ -0,0 +1,12 @@
+CREATE TYPE policy_status AS ENUM ('DRAFT', 'ACTIVE');
+
+CREATE TABLE policies (
+    id TEXT PRIMARY KEY,
+    organization_id TEXT REFERENCES organizations(id) NOT NULL,
+    name TEXT NOT NULL,
+    content TEXT NOT NULL,
+    status policy_status NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    version INTEGER NOT NULL
+); 
\ No newline at end of file
diff --git a/pkg/probo/coredata/policy.go b/pkg/probo/coredata/policy.go
new file mode 100644
index 000000000..2a893dd4a
--- /dev/null
+++ b/pkg/probo/coredata/policy.go
@@ -0,0 +1,250 @@
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	Policy struct {
+		ID             gid.GID      `db:"id"`
+		OrganizationID gid.GID      `db:"organization_id"`
+		Status         PolicyStatus `db:"status"`
+		Name           string       `db:"name"`
+		Content        string       `db:"content"`
+		CreatedAt      time.Time    `db:"created_at"`
+		UpdatedAt      time.Time    `db:"updated_at"`
+		Version        int          `db:"version"`
+	}
+
+	Policies []*Policy
+
+	UpdatePolicyParams struct {
+		ExpectedVersion int
+		Name            *string
+		Content         *string
+		Status          *PolicyStatus
+	}
+)
+
+func (p Policy) CursorKey() page.CursorKey {
+	return page.NewCursorKey(p.ID, p.CreatedAt)
+}
+
+func (p *Policy) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+	policyID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+	status,
+    content,
+    created_at,
+    updated_at,
+    version
+FROM
+    policies
+WHERE
+    %s
+    AND id = @policy_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"policy_id": policyID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query policies: %w", err)
+	}
+
+	policy, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Policy])
+	if err != nil {
+		return fmt.Errorf("cannot collect policy: %w", err)
+	}
+
+	*p = policy
+
+	return nil
+}
+
+func (p *Policies) LoadByOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+	organizationID gid.GID,
+	cursor *page.Cursor,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    name,
+	status,
+    content,
+    created_at,
+    updated_at,
+    version
+FROM
+    policies
+WHERE
+    %s
+    AND organization_id = @organization_id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"organization_id": organizationID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query policies: %w", err)
+	}
+
+	policies, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Policy])
+	if err != nil {
+		return fmt.Errorf("cannot collect policies: %w", err)
+	}
+
+	*p = policies
+
+	return nil
+}
+
+func (p Policy) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+INSERT INTO
+    policies (
+        id,
+        organization_id,
+        name,
+		status,
+        content,
+        created_at,
+        updated_at,
+        version
+    )
+VALUES (
+    @policy_id,
+    @organization_id,
+    @name,
+    @status,
+    @content,
+    @created_at,
+    @updated_at,
+    @version
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"policy_id":       p.ID,
+		"organization_id": p.OrganizationID,
+		"name":            p.Name,
+		"status":          p.Status,
+		"content":         p.Content,
+		"created_at":      p.CreatedAt,
+		"updated_at":      p.UpdatedAt,
+		"version":         p.Version,
+	}
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (p Policy) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+) error {
+	q := `
+DELETE FROM policies WHERE %s AND id = @policy_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"policy_id": p.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	return err
+}
+
+func (p *Policy) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope *Scope,
+	params UpdatePolicyParams,
+) error {
+	q := `
+UPDATE policies SET
+    name = COALESCE(@name, name),
+    status = COALESCE(@status, status),
+    content = COALESCE(@content, content),
+    updated_at = @updated_at,
+    version = version + 1
+WHERE %s
+    AND id = @policy_id
+    AND version = @expected_version
+RETURNING 
+    id,
+    organization_id,
+    name,
+    content,
+    created_at,
+    updated_at,
+	status,
+    version
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"policy_id":        p.ID,
+		"expected_version": params.ExpectedVersion,
+		"updated_at":       time.Now(),
+	}
+
+	if params.Name != nil {
+		args["name"] = *params.Name
+	}
+	if params.Content != nil {
+		args["content"] = *params.Content
+	}
+	if params.Status != nil {
+		args["status"] = *params.Status
+	}
+
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query policies: %w", err)
+	}
+
+	policy, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Policy])
+	if err != nil {
+		return fmt.Errorf("cannot collect policy: %w", err)
+	}
+
+	*p = policy
+
+	return nil
+}
diff --git a/pkg/probo/coredata/policy_status.go b/pkg/probo/coredata/policy_status.go
new file mode 100644
index 000000000..ab8e19345
--- /dev/null
+++ b/pkg/probo/coredata/policy_status.go
@@ -0,0 +1,74 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type (
+	PolicyStatus uint8
+)
+
+const (
+	PolicyStatusDraft PolicyStatus = iota
+	PolicyStatusActive
+)
+
+func (ps PolicyStatus) MarshalText() ([]byte, error) {
+	return []byte(ps.String()), nil
+}
+
+func (ps *PolicyStatus) UnmarshalText(data []byte) error {
+	val := string(data)
+
+	switch val {
+	case PolicyStatusDraft.String():
+		*ps = PolicyStatusDraft
+	case PolicyStatusActive.String():
+		*ps = PolicyStatusActive
+	default:
+		return fmt.Errorf("invalid PolicyStatus value: %q", val)
+	}
+
+	return nil
+}
+
+func (ps PolicyStatus) String() string {
+	var val string
+
+	switch ps {
+	case PolicyStatusDraft:
+		val = "DRAFT"
+	case PolicyStatusActive:
+		val = "ACTIVE"
+	}
+
+	return val
+}
+
+func (ps *PolicyStatus) Scan(value any) error {
+	val, ok := value.(string)
+	if !ok {
+		return fmt.Errorf("invalid scan source for PolicyStatus, expected string got %T", value)
+	}
+
+	return ps.UnmarshalText([]byte(val))
+}
+
+func (ps PolicyStatus) Value() (driver.Value, error) {
+	return ps.String(), nil
+}
diff --git a/pkg/probo/policy_service.go b/pkg/probo/policy_service.go
new file mode 100644
index 000000000..abc77d5b7
--- /dev/null
+++ b/pkg/probo/policy_service.go
@@ -0,0 +1,162 @@
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/getprobo/probo/pkg/probo/coredata"
+	"go.gearno.de/kit/pg"
+)
+
+type PolicyService struct {
+	svc *Service
+}
+
+type (
+	CreatePolicyRequest struct {
+		OrganizationID gid.GID
+		Name           string
+		Status         coredata.PolicyStatus
+		Content        string
+	}
+
+	UpdatePolicyRequest struct {
+		ID              gid.GID
+		ExpectedVersion int
+		Name            *string
+		Content         *string
+		Status          *coredata.PolicyStatus
+	}
+)
+
+func (s *PolicyService) Get(
+	ctx context.Context,
+	policyID gid.GID,
+) (*coredata.Policy, error) {
+	policy := &coredata.Policy{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return policy.LoadByID(ctx, conn, s.svc.scope, policyID)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return policy, nil
+}
+
+func (s *PolicyService) Create(
+	ctx context.Context,
+	req CreatePolicyRequest,
+) (*coredata.Policy, error) {
+	now := time.Now()
+	policyID, err := gid.NewGID(coredata.PolicyEntityType)
+	if err != nil {
+		return nil, fmt.Errorf("cannot create policy global id: %w", err)
+	}
+
+	organization := &coredata.Organization{}
+	policy := &coredata.Policy{
+		ID:             policyID,
+		OrganizationID: req.OrganizationID,
+		Name:           req.Name,
+		Content:        req.Content,
+		Status:         req.Status,
+		CreatedAt:      now,
+		UpdatedAt:      now,
+	}
+
+	err = s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := organization.LoadByID(ctx, conn, s.svc.scope, req.OrganizationID); err != nil {
+				return fmt.Errorf("cannot load organization %q: %w", req.OrganizationID, err)
+			}
+
+			if err := policy.Insert(ctx, conn); err != nil {
+				return fmt.Errorf("cannot insert policy: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return policy, nil
+}
+
+func (s *PolicyService) Update(
+	ctx context.Context,
+	req UpdatePolicyRequest,
+) (*coredata.Policy, error) {
+	params := coredata.UpdatePolicyParams{
+		ExpectedVersion: req.ExpectedVersion,
+		Name:            req.Name,
+		Content:         req.Content,
+		Status:          req.Status,
+	}
+
+	policy := &coredata.Policy{ID: req.ID}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(conn pg.Conn) error {
+			return policy.Update(ctx, conn, s.svc.scope, params)
+		})
+	if err != nil {
+		return nil, err
+	}
+
+	return policy, nil
+}
+
+func (s *PolicyService) Delete(
+	ctx context.Context,
+	policyID gid.GID,
+) error {
+	policy := coredata.Policy{ID: policyID}
+
+	return s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return policy.Delete(ctx, conn, s.svc.scope)
+		},
+	)
+}
+
+func (s *PolicyService) ListByOrganization(
+	ctx context.Context,
+	organizationID gid.GID,
+	cursor *page.Cursor,
+) (*page.Page[*coredata.Policy], error) {
+	var policies coredata.Policies
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			return policies.LoadByOrganizationID(
+				ctx,
+				conn,
+				s.svc.scope,
+				organizationID,
+				cursor,
+			)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(policies, cursor), nil
+}
diff --git a/pkg/probo/probo.go b/pkg/probo/service.go
similarity index 86%
rename from pkg/probo/probo.go
rename to pkg/probo/service.go
index 7f25e9cb3..9fcb31e6a 100644
--- a/pkg/probo/probo.go
+++ b/pkg/probo/service.go
@@ -30,10 +30,17 @@ type (
 		scope  *coredata.Scope
 		s3     *s3.Client
 		bucket string
+
+		Policies *PolicyService
 	}
 )
 
-func NewService(ctx context.Context, pgClient *pg.Client, s3Client *s3.Client, bucket string) (*Service, error) {
+func NewService(
+	ctx context.Context,
+	pgClient *pg.Client,
+	s3Client *s3.Client,
+	bucket string,
+) (*Service, error) {
 	err := migrator.NewMigrator(pgClient, coredata.Migrations).Run(ctx, "migrations")
 	if err != nil {
 		return nil, fmt.Errorf("cannot migrate database schema: %w", err)
@@ -43,10 +50,14 @@ func NewService(ctx context.Context, pgClient *pg.Client, s3Client *s3.Client, b
 		return nil, fmt.Errorf("bucket is required")
 	}
 
-	return &Service{
+	svc := &Service{
 		pg:     pgClient,
 		s3:     s3Client,
 		scope:  coredata.NewScope(), // must be created from auth
 		bucket: bucket,
-	}, nil
+	}
+
+	svc.Policies = &PolicyService{svc: svc}
+
+	return svc, nil
 }