{
  "object": "curbi.policy_templates",
  "templates": [
    {
      "id": "ai-agent-verification",
      "category": "ai-agents",
      "title": "AI agents: verification policy for AI startups",
      "description": "A verification policy, not a security product. For AI startups whose agents act on accounts, data, credentials or billing. Catches an agent claiming a security or data action with no record (deleted, revoked, rotated, patched, disabled, restored, exported, granted, deployed, refunded), security and compliance assurances it must not give, guarantees, and prices or discounts that differ from yours. Deterministic and checked locally. It does not detect prompt injection, leaked secrets, paraphrased claims or attacks, and it does not encrypt, authenticate, patch or audit anything.",
      "url": "https://curbi.io/policies/ai-agent-verification.json",
      "cases": 19
    },
    {
      "id": "coding-agent-claims",
      "category": "ai-agents",
      "title": "AI agents: coding-agent claims",
      "description": "A verification policy, not a security product. For coding agents that commit, push, merge, deploy or run tests. Catches an agent saying it committed, pushed, merged, deployed, released, published, migrated, installed, reverted, opened a pull request, ran tests or fixed something with no record; and claims that tests pass, CI is green or the change is production ready. A fix claim needs a passing-test record. Deterministic and checked locally. It does not run tests, read CI or inspect code, does not check which branch or commit a record names, and a reworded claim is not caught.",
      "url": "https://curbi.io/policies/coding-agent-claims.json",
      "cases": 20
    },
    {
      "id": "ecommerce-orders",
      "category": "ecommerce",
      "title": "E-commerce: orders, refunds and pricing",
      "description": "For shopping and order-support agents. Catches refunds, cancellations and shipments claimed with no record, wrong shipping or add-on prices, unapproved discounts, and promises the store does not make.",
      "url": "https://curbi.io/policies/ecommerce-orders.json",
      "cases": 12
    },
    {
      "id": "finance-transactions",
      "category": "finance",
      "title": "Finance: transactions, fees and limits",
      "description": "For banking and payments agents. Catches transfers, reversals, waivers and approvals claimed with no record, wrong fees and limits, and promises about returns, risk or taxes.",
      "url": "https://curbi.io/policies/finance-transactions.json",
      "cases": 12
    },
    {
      "id": "mcp-tool-claims",
      "category": "ai-agents",
      "title": "AI agents: MCP and tool-call claims",
      "description": "A verification policy, not a security product. For agents that use MCP servers or other tools. Catches an agent saying it called a tool, or that a tool sent, created, updated, uploaded or booked something, with no record of the call; assurances that a call succeeded; and a tool result restated differently from the value on record. Deterministic and checked locally. It does not see the tool calls themselves, does not check which tool a record came from, does not read tool results unless the host puts them in the record, and does not detect prompt injection in tool output.",
      "url": "https://curbi.io/policies/mcp-tool-claims.json",
      "cases": 18
    },
    {
      "id": "saas-billing",
      "category": "saas",
      "title": "SaaS: billing, plan changes and trials",
      "description": "For billing and account agents. Catches plan changes, refunds, credits and trial extensions claimed with no record, wrong plan prices, unapproved discounts, and promises like unlimited usage or locked prices.",
      "url": "https://curbi.io/policies/saas-billing.json",
      "cases": 13
    },
    {
      "id": "support-escalation",
      "category": "support",
      "title": "Support: escalation and resolution",
      "description": "For support agents. Catches escalations, assignments, fixes and resolutions claimed with no record, response-time promises, and apologies that make commitments.",
      "url": "https://curbi.io/policies/support-escalation.json",
      "cases": 10
    }
  ]
}