AI Agent Policy Pages

The existing policy UI in bob-wire (c0, c1, c6, c10) was built around infrastructure-era security — data residency, vendor allowlists, PII compliance. The synthetic data powering those pages doesn't reflect the new reality: AI agents as autonomous actors with credential access, outbound network capability, and destructive command authority. The PocketOS incident (April 2026) crystallized six concrete intervention points into enforceable policies. The bob-wire policy pages need to tell that story with data that matches.

Replace the existing policy synthetic data in bob-wire's security/policy pages with AI agent security policies derived from the AI Policy Starter Pack (brand/ai_policy_starter_pack.md). Update the wireframes and mockups to reflect the new policy model — new rule types, AI-specific violation scenarios, trust scoring, and the "Lethal Trifecta" enforcement progression.

In scope:

• New synthetic data: 6 policies (POL-001 through POL-006) with AI-specific rule types (on_file_read, on_net_connect, on_command_exec, on_agent_start, continuous trust scoring)
• Violation scenarios grounded in the PocketOS incident timeline (credential discovery → external connection → destructive mutation)
• Updated policy model fields: trigger hooks, enforcement tiers, trust scores, agent classifications
• Target pages in bob-wire: policy listing, policy detail, violation detail, remediation tracking
• Remediation data reflecting the new enforcement modes (redaction, allowlist blocking, gate denial, trust-based escalation)

Out of scope:

• New wireframe/mockup pages (use existing page structures)
• Changes to Wire* or Ux* component APIs
• Changes to the design site itself (this cycle lives in bob-wire's pages)
• The trust score visualization (that's a separate design problem)

1. Policy data model expansion — new rule types beyond allowed_regions/blocked_vendors: trigger hooks (on_file_read, on_net_connect, on_command_exec), match patterns (regex, path globs, destructive verbs), actions (redact, block, gate, escalate, suspend)
2. Trust score as a first-class field — policies now carry a trust impact dimension, and the violation model includes trust score at time of violation
3. Agent classification — POL-006 introduces a new entity type (agent permission level) that the listing page needs to surface
4. PocketOS incident as through-line — violation and remediation data tells a coherent story: the same 9-second incident seen through each policy's lens

Bob-wire policy pages populated with AI agent security data that demonstrates Qpoint's runtime enforcement thesis — prevention at the source, not detection at the boundary. The synthetic data is grounded enough to use in demos and storytelling.

• brand/ai_policy_starter_pack.md — 6 policies, definitions, PocketOS mappings, visual test cases
• bob-wire/app/pages/c1/learnings/policy-starter-pack.md — existing 16-policy enterprise pack (infrastructure-era reference)
• Bob-wire policy pages: c0/policies-v2, c1/policy-compliance-v1, c6/dashboard-v1/security, c10/security-global-overview-v1