Drafting rConfig compliance policies with AI Generate Rules
Writing a policy definition from a blank editor is slow, and most of the work is boilerplate. AI Generate Rules drafts the rules for you: generic ones from your policy’s name and description, or specific ones from a config you paste in. You then do the part that matters: make sure each rule passes good configs and fails bad ones.
Generic or from a config
| Leave the config box | You get | Use when |
|---|---|---|
| Empty | Generic CIS/NIST-style rules for the platform your policy name and description imply | Starting a baseline for a platform |
| Filled with a running config | Rules matching that config’s actual interfaces, logging and services | Capturing a known-good device as your standard |
Credentials in the pasted config are redacted before sending, and up to 8 KB of it is used. Give the policy a precise name and description first (“Cisco IOS XE access switch management-plane baseline”); the generic mode works from them.
From draft to trusted policy
- Generate. rConfig asks before replacing the editor content; the rules arrive as an unsaved draft.
- Read every rule. Delete rules that don’t reflect your standard. A generated rule is a suggestion, not a requirement.
- Check the match strings. Each rule matches exact config text. Compare it with real configs from your devices: a single extra space or different keyword means the rule never matches.
- Test both ways. Run the policy against a device you know is good and one you know is bad. A good policy passes the first and fails the second, for the reasons you expect.
- Save, assign, review results. Then watch the first compliance report for surprises.
Where the Policy Library fits
The Policy Library has worked definitions with a passing config, a failing config and the result rConfig reports, every one asserted by a test. Where a rule you need exists there, start from it. Use AI Generate Rules for your organisation’s own standards, then test the draft the way the library’s examples are tested. The library’s patterns and false-positive guide are worth reading before tightening generated rules.
Why this is the one AI write
Every other Iris feature only reads. Rule generation produces text you can save into rConfig’s policy store. It still never touches a device, and nothing is written until you click save. See Read-only by design.
Related reference
- Policy & Compliance Narration: draft policy rules
- Policy definition editor
- Policy definitions
- Policy Library
Frequently asked questions
Can AI write rConfig policy definitions?
It can draft them. AI Generate Rules in the policy definition editor produces rules from your policy's name and description, or from a config you paste in. You review, test and save them.
Is the pasted config sent to the AI provider?
Up to 8 KB of it, with credentials redacted first. Leave the box empty to get generic rules without sending any config.
Should I use AI-generated rules or the Policy Library?
Start from the Policy Library where a tested rule exists, since every result there is asserted by a test. Use AI to draft rules for your own standards, then test them the same way.