> For the complete documentation index, see [llms.txt](https://govplane.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://govplane.gitbook.io/docs/documentation/resources/10-practical-governance-policies-for-production-saas-systems-with-ready-to-import-templates.md).
# 10 Practical Governance Policies for Production SaaS Systems — With Ready-to-Import Templates
Runtime governance policies let engineering teams change how a system behaves — rate limits, access rules, kill switches, compliance controls — without shipping new code or waiting for a deploy cycle.
This guide covers the ten categories that appear most frequently in production SaaS platforms. Each section includes a ready-to-use policy definition that you can import directly into [Govplane](https://govplane.com) using the **Policy Import** feature.
{% hint style="info" %}
**How to use these templates.** Copy the JSON block from any section below. In the Govplane dashboard, navigate to **Policies → Import**, paste the JSON, choose a conflict strategy (`overwrite` to replace an existing policy with the same key, or `copy` to create a duplicate), and confirm. Each policy carries its own `env` value — swap `"test"` for `"prod"` when you are ready to go live.
{% endhint %}
{% hint style="warning" %}
**Important — customize before use.** The policies in this guide are starting templates, not production-ready configurations. Service names, resource paths, threshold values, country lists, role identifiers, and condition paths **must be edited to match your application's actual architecture and business requirements** before activation. Import them, review every rule, and adjust to fit your platform.
{% endhint %}
{% hint style="warning" %}
**It is important to understand how Govplane works.** Govplane is a policy evaluation engine. It receives an **evaluation context** — a structured object that your application assembles and passes at decision time — and returns an effect (`allow`, `deny`, `throttle`, `kill_switch`, or `custom`) based on the active policy rules. Govplane does **not** track request counts, measure rate-limit windows, resolve IP geolocation, detect abuse patterns, or store any runtime telemetry. Fields such as `request.geo.country`, throttle counters, or `tenant.plan` must be populated by your application or infrastructure (API gateway, CDN, identity provider, billing system) and included in the evaluation context. The policy templates in this guide reference these context paths as examples — your application is responsible for providing the actual values at evaluation time.
{% endhint %}
***
**Don't have a Govplane account yet? Get started right now for free!**
Start for free now →
***
### 1. API Rate Limiting
Uncontrolled request volume is the most common cause of degraded latency and downstream service saturation. A rate-limiting policy defines the ceiling per identity axis (IP, authenticated user, or tenant) so that enforcement is consistent, observable, and adjustable without a code change.
The template below throttles any API endpoint to 200 requests per 60-second window, keyed by IP address, and falls back to an `allow` default so legitimate traffic is never blocked when the limit is not exceeded.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "api-rate-limiting",
"env": "test",
"friendlyName": "API Rate Limiting",
"description": "Caps request frequency across public API endpoints to prevent abuse and protect downstream services.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "rl-global-ip",
"status": "active",
"priority": 100,
"target": { "service": "api-gateway", "resource": "*", "action": "request" },
"effect": {
"type": "throttle",
"throttle": { "limit": 200, "windowSeconds": 60, "key": "ip" }
},
"description": "Throttle all API requests to 200 req/min per IP"
}
],
"metadata": { "reason": "Baseline API rate limiting" }
}
}
]
}
```
***
### 2. Anonymous Access Control
Unauthenticated callers should only reach a narrow set of public resources. An anonymous-access policy denies by default and explicitly allows the endpoints that do not require identity — sign-up, login, public docs, health checks — reducing the attack surface without touching application middleware.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "anonymous-access-control",
"env": "test",
"friendlyName": "Anonymous Access Control",
"description": "Denies unauthenticated traffic by default, allowing only explicitly listed public endpoints.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "deny" },
"rules": [
{
"id": "anon-allow-public",
"status": "active",
"priority": 100,
"target": { "service": "api-gateway", "resource": "public/*", "action": "read" },
"effect": { "type": "allow" },
"description": "Allow anonymous read access to public endpoints"
},
{
"id": "anon-allow-auth",
"status": "active",
"priority": 90,
"target": { "service": "auth", "resource": "session", "action": "create" },
"effect": { "type": "allow" },
"description": "Allow anonymous login and registration"
}
],
"metadata": { "reason": "Restrict unauthenticated callers to a narrow public surface" }
}
}
]
}
```
***
### 3. Free-Tier Resource Limits
Freemium models depend on enforcing resource ceilings that encourage upgrades without frustrating legitimate exploration. This policy denies resource-creation actions when the request context signals a free-tier plan, while leaving read operations unrestricted.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "free-tier-resource-limits",
"env": "test",
"friendlyName": "Free-Tier Resource Limits",
"description": "Caps write operations for free-tier accounts to enforce plan limits at runtime.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "free-deny-write",
"status": "active",
"priority": 100,
"target": { "service": "*", "resource": "*", "action": "create" },
"when": { "op": "eq", "path": "tenant.plan", "value": "free" },
"thenEffect": { "type": "deny" },
"effect": { "type": "allow" },
"description": "Deny resource creation for free-tier tenants"
},
{
"id": "free-throttle-read",
"status": "active",
"priority": 90,
"target": { "service": "*", "resource": "*", "action": "read" },
"when": { "op": "eq", "path": "tenant.plan", "value": "free" },
"thenEffect": {
"type": "throttle",
"throttle": { "limit": 60, "windowSeconds": 60, "key": "tenant" }
},
"effect": { "type": "allow" },
"description": "Throttle reads for free-tier tenants to 60 req/min"
}
],
"metadata": { "reason": "Enforce freemium boundaries without code changes" }
}
}
]
}
```
***
### 4. High-Risk Transaction Blocking
Anomalous financial or data-mutation operations — unusually large amounts, bulk deletes, privilege escalations — can be blocked inline before they reach the business layer. The rule below denies any transaction where the amount exceeds a configurable threshold.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "high-risk-transaction-blocking",
"env": "test",
"friendlyName": "High-Risk Transaction Blocking",
"description": "Blocks transactions that exceed risk thresholds such as unusually large monetary amounts.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "block-large-amount",
"status": "active",
"priority": 100,
"target": { "service": "payments", "resource": "transaction", "action": "create" },
"when": { "op": "gt", "path": "request.body.amount", "value": 10000 },
"thenEffect": { "type": "deny" },
"effect": { "type": "allow" },
"description": "Deny transactions exceeding 10 000 currency units"
},
{
"id": "block-bulk-delete",
"status": "active",
"priority": 90,
"target": { "service": "*", "resource": "*", "action": "delete" },
"when": { "op": "gt", "path": "request.body.count", "value": 100 },
"thenEffect": { "type": "deny" },
"effect": { "type": "allow" },
"description": "Deny bulk delete operations exceeding 100 records"
}
],
"metadata": { "reason": "Inline risk boundary for financial and destructive operations" }
}
}
]
}
```
***
### 5. Geographic Restrictions
Regulatory obligations and sanctions programs require blocking or limiting access from specific jurisdictions. By evaluating the country code present in the request context, this policy can deny entire regions without requiring network-layer configuration.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "geographic-restrictions",
"env": "test",
"friendlyName": "Geographic Restrictions",
"description": "Blocks access from restricted jurisdictions based on the request's resolved country code.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "geo-block-sanctioned",
"status": "active",
"priority": 100,
"target": { "service": "*", "resource": "*", "action": "*" },
"when": { "op": "in", "path": "request.geo.country", "values": ["KP", "IR", "SY", "CU"] },
"thenEffect": { "type": "deny" },
"effect": { "type": "allow" },
"description": "Deny all access from OFAC-sanctioned countries"
}
],
"metadata": { "reason": "Sanctions compliance — deny traffic from restricted jurisdictions" }
}
}
]
}
```
***
### 6. Feature Rollout Control
Progressive delivery requires gating new capabilities behind runtime conditions — user cohort, tenant flag, percentage — rather than compile-time feature toggles. The policy below allows a new feature only when the tenant has the corresponding beta flag enabled.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "feature-rollout-control",
"env": "test",
"friendlyName": "Feature Rollout Control",
"description": "Gates access to new features based on runtime tenant flags for controlled progressive delivery.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "deny" },
"rules": [
{
"id": "beta-feature-gate",
"status": "active",
"priority": 100,
"target": { "service": "app", "resource": "feature/new-dashboard", "action": "access" },
"when": { "op": "eq", "path": "tenant.flags.beta", "value": true },
"thenEffect": { "type": "allow" },
"effect": { "type": "deny" },
"description": "Allow access to new-dashboard only for tenants with the beta flag"
}
],
"metadata": { "reason": "Controlled rollout — new-dashboard gated by tenant beta flag" }
}
}
]
}
```
***
### 7. Abuse Detection
Automated attacks — credential stuffing, web scraping, enumeration — share a common pattern: high-frequency, repetitive requests against authentication and data endpoints. A throttle rule at the policy layer limits the blast radius while security teams investigate.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "abuse-detection",
"env": "test",
"friendlyName": "Abuse Detection",
"description": "Throttles high-frequency automated patterns targeting authentication and data-export endpoints.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "abuse-auth-throttle",
"status": "active",
"priority": 100,
"target": { "service": "auth", "resource": "session", "action": "create" },
"effect": {
"type": "throttle",
"throttle": { "limit": 10, "windowSeconds": 60, "key": "ip" }
},
"description": "Limit login attempts to 10 per minute per IP"
},
{
"id": "abuse-export-throttle",
"status": "active",
"priority": 90,
"target": { "service": "data", "resource": "export", "action": "create" },
"effect": {
"type": "throttle",
"throttle": { "limit": 5, "windowSeconds": 300, "key": "user" }
},
"description": "Limit data exports to 5 per 5 minutes per user"
}
],
"metadata": { "reason": "Automated abuse mitigation — auth and data-export surfaces" }
}
}
]
}
```
***
### 8. Operational Kill Switch
When an incident requires taking a service offline immediately, an operations team needs a mechanism that takes effect in seconds, not minutes. A kill-switch policy disables the target service at the governance layer while providing a structured reason for audit trails.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "operational-kill-switch",
"env": "test",
"friendlyName": "Operational Kill Switch",
"description": "Instantly disables a target service during incidents without requiring a code deploy.",
"status": "disabled",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "kill-payments",
"status": "active",
"priority": 1000,
"target": { "service": "payments", "resource": "*", "action": "*" },
"effect": {
"type": "kill_switch",
"killSwitch": { "service": "payments", "reason": "Service disabled during incident investigation" }
},
"description": "Kill switch for the entire payments service"
}
],
"metadata": { "reason": "Emergency kill switch — activate by enabling the policy" }
}
}
]
}
```
> **Note.** This policy is imported with `status: "disabled"`. Enable it from the dashboard when you need to activate the kill switch. Disable it again to restore normal operation.
***
### 9. Partner API Restrictions
Third-party integrations and partner APIs often require tighter quotas and narrower access scopes than first-party consumers. This policy applies per-tenant throttling and restricts operations to read-only for any caller with a `partner` role.
{
"version": "1.0",
"policies": [
{
"policyKey": "partner-api-restrictions",
"env": "test",
"friendlyName": "Partner API Restrictions",
"description": "Enforces tighter rate limits and read-only access for partner integrations.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "partner-throttle",
"status": "active",
"priority": 100,
"target": { "service": "api-gateway", "resource": "*", "action": "request" },
"when": { "op": "eq", "path": "user.role", "value": "partner" },
"thenEffect": {
"type": "throttle",
"throttle": { "limit": 100, "windowSeconds": 60, "key": "tenant" }
},
"effect": { "type": "allow" },
"description": "Throttle partner traffic to 100 req/min per tenant"
},
{
"id": "partner-deny-write",
"status": "active",
"priority": 90,
"target": { "service": "*", "resource": "*", "action": "create" },
"when": { "op": "eq", "path": "user.role", "value": "partner" },
"thenEffect": { "type": "deny" },
"effect": { "type": "allow" },
"description": "Deny write operations for partner callers"
}
],
"metadata": { "reason": "Enforce partner access boundaries — read-only, rate-limited" }
}
}
]
}
***
### 10. Compliance Enforcement
Regulatory frameworks — SOC 2, GDPR, ITAR, EAR — often mandate that certain data or operations are restricted based on user jurisdiction, data classification, or account type. A compliance policy encodes these rules so they are evaluated consistently at runtime, producing an auditable decision trail.
```json
{
"version": "1.0",
"policies": [
{
"policyKey": "compliance-enforcement",
"env": "test",
"friendlyName": "Compliance Enforcement",
"description": "Enforces regulatory access controls based on jurisdiction and data classification.",
"status": "active",
"activeVersion": 1,
"snapshot": {
"defaults": { "effect": "allow" },
"rules": [
{
"id": "compliance-export-control",
"status": "active",
"priority": 100,
"target": { "service": "data", "resource": "controlled/*", "action": "*" },
"when": { "op": "in", "path": "request.geo.country", "values": ["KP", "IR", "SY", "CU", "RU", "BY"] },
"thenEffect": { "type": "deny" },
"effect": { "type": "allow" },
"description": "Deny access to export-controlled data from sanctioned jurisdictions"
},
{
"id": "compliance-pii-restrict",
"status": "active",
"priority": 90,
"target": { "service": "data", "resource": "pii/*", "action": "read" },
"when": {
"op": "not",
"condition": { "op": "eq", "path": "user.role", "value": "compliance-officer" }
},
"thenEffect": { "type": "deny" },
"effect": { "type": "allow" },
"description": "Restrict PII access to compliance officers only"
}
],
"metadata": { "reason": "Regulatory compliance — export controls and PII access restrictions" }
}
}
]
}
```
***
### Import All Ten Policies at Once
You can import every policy from this guide in a single operation. Combine the `policies` arrays into one payload:
```json
{
"version": "1.0",
"policies": [
{ "policyKey": "api-rate-limiting", "env": "test", "friendlyName": "API Rate Limiting", "description": "Caps request frequency across public API endpoints to prevent abuse and protect downstream services.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "rl-global-ip", "status": "active", "priority": 100, "target": { "service": "api-gateway", "resource": "*", "action": "request" }, "effect": { "type": "throttle", "throttle": { "limit": 200, "windowSeconds": 60, "key": "ip" } }, "description": "Throttle all API requests to 200 req/min per IP" }], "metadata": { "reason": "Baseline API rate limiting" } } },
{ "policyKey": "anonymous-access-control", "env": "test", "friendlyName": "Anonymous Access Control", "description": "Denies unauthenticated traffic by default, allowing only explicitly listed public endpoints.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "deny" }, "rules": [{ "id": "anon-allow-public", "status": "active", "priority": 100, "target": { "service": "api-gateway", "resource": "public/*", "action": "read" }, "effect": { "type": "allow" }, "description": "Allow anonymous read access to public endpoints" }, { "id": "anon-allow-auth", "status": "active", "priority": 90, "target": { "service": "auth", "resource": "session", "action": "create" }, "effect": { "type": "allow" }, "description": "Allow anonymous login and registration" }], "metadata": { "reason": "Restrict unauthenticated callers to a narrow public surface" } } },
{ "policyKey": "free-tier-resource-limits", "env": "test", "friendlyName": "Free-Tier Resource Limits", "description": "Caps write operations for free-tier accounts to enforce plan limits at runtime.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "free-deny-write", "status": "active", "priority": 100, "target": { "service": "*", "resource": "*", "action": "create" }, "when": { "op": "eq", "path": "tenant.plan", "value": "free" }, "thenEffect": { "type": "deny" }, "effect": { "type": "allow" }, "description": "Deny resource creation for free-tier tenants" }, { "id": "free-throttle-read", "status": "active", "priority": 90, "target": { "service": "*", "resource": "*", "action": "read" }, "when": { "op": "eq", "path": "tenant.plan", "value": "free" }, "thenEffect": { "type": "throttle", "throttle": { "limit": 60, "windowSeconds": 60, "key": "tenant" } }, "effect": { "type": "allow" }, "description": "Throttle reads for free-tier tenants to 60 req/min" }], "metadata": { "reason": "Enforce freemium boundaries without code changes" } } },
{ "policyKey": "high-risk-transaction-blocking", "env": "test", "friendlyName": "High-Risk Transaction Blocking", "description": "Blocks transactions that exceed risk thresholds such as unusually large monetary amounts.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "block-large-amount", "status": "active", "priority": 100, "target": { "service": "payments", "resource": "transaction", "action": "create" }, "when": { "op": "gt", "path": "request.body.amount", "value": 10000 }, "thenEffect": { "type": "deny" }, "effect": { "type": "allow" }, "description": "Deny transactions exceeding 10 000 currency units" }, { "id": "block-bulk-delete", "status": "active", "priority": 90, "target": { "service": "*", "resource": "*", "action": "delete" }, "when": { "op": "gt", "path": "request.body.count", "value": 100 }, "thenEffect": { "type": "deny" }, "effect": { "type": "allow" }, "description": "Deny bulk delete operations exceeding 100 records" }], "metadata": { "reason": "Inline risk boundary for financial and destructive operations" } } },
{ "policyKey": "geographic-restrictions", "env": "test", "friendlyName": "Geographic Restrictions", "description": "Blocks access from restricted jurisdictions based on the request's resolved country code.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "geo-block-sanctioned", "status": "active", "priority": 100, "target": { "service": "*", "resource": "*", "action": "*" }, "when": { "op": "in", "path": "request.geo.country", "values": ["KP", "IR", "SY", "CU"] }, "thenEffect": { "type": "deny" }, "effect": { "type": "allow" }, "description": "Deny all access from OFAC-sanctioned countries" }], "metadata": { "reason": "Sanctions compliance — deny traffic from restricted jurisdictions" } } },
{ "policyKey": "feature-rollout-control", "env": "test", "friendlyName": "Feature Rollout Control", "description": "Gates access to new features based on runtime tenant flags for controlled progressive delivery.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "deny" }, "rules": [{ "id": "beta-feature-gate", "status": "active", "priority": 100, "target": { "service": "app", "resource": "feature/new-dashboard", "action": "access" }, "when": { "op": "eq", "path": "tenant.flags.beta", "value": true }, "thenEffect": { "type": "allow" }, "effect": { "type": "deny" }, "description": "Allow access to new-dashboard only for tenants with the beta flag" }], "metadata": { "reason": "Controlled rollout — new-dashboard gated by tenant beta flag" } } },
{ "policyKey": "abuse-detection", "env": "test", "friendlyName": "Abuse Detection", "description": "Throttles high-frequency automated patterns targeting authentication and data-export endpoints.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "abuse-auth-throttle", "status": "active", "priority": 100, "target": { "service": "auth", "resource": "session", "action": "create" }, "effect": { "type": "throttle", "throttle": { "limit": 10, "windowSeconds": 60, "key": "ip" } }, "description": "Limit login attempts to 10 per minute per IP" }, { "id": "abuse-export-throttle", "status": "active", "priority": 90, "target": { "service": "data", "resource": "export", "action": "create" }, "effect": { "type": "throttle", "throttle": { "limit": 5, "windowSeconds": 300, "key": "user" } }, "description": "Limit data exports to 5 per 5 minutes per user" }], "metadata": { "reason": "Automated abuse mitigation — auth and data-export surfaces" } } },
{ "policyKey": "operational-kill-switch", "env": "test", "friendlyName": "Operational Kill Switch", "description": "Instantly disables a target service during incidents without requiring a code deploy.", "status": "disabled", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "kill-payments", "status": "active", "priority": 1000, "target": { "service": "payments", "resource": "*", "action": "*" }, "effect": { "type": "kill_switch", "killSwitch": { "service": "payments", "reason": "Service disabled during incident investigation" } }, "description": "Kill switch for the entire payments service" }], "metadata": { "reason": "Emergency kill switch — activate by enabling the policy" } } },
{ "policyKey": "partner-api-restrictions", "env": "test", "friendlyName": "Partner API Restrictions", "description": "Enforces tighter rate limits and read-only access for partner integrations.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "partner-throttle", "status": "active", "priority": 100, "target": { "service": "api-gateway", "resource": "*", "action": "request" }, "when": { "op": "eq", "path": "user.role", "value": "partner" }, "thenEffect": { "type": "throttle", "throttle": { "limit": 100, "windowSeconds": 60, "key": "tenant" } }, "effect": { "type": "allow" }, "description": "Throttle partner traffic to 100 req/min per tenant" }, { "id": "partner-deny-write", "status": "active", "priority": 90, "target": { "service": "*", "resource": "*", "action": "create" }, "when": { "op": "eq", "path": "user.role", "value": "partner" }, "thenEffect": { "type": "deny" }, "effect": { "type": "allow" }, "description": "Deny write operations for partner callers" }], "metadata": { "reason": "Enforce partner access boundaries — read-only, rate-limited" } } },
{ "policyKey": "compliance-enforcement", "env": "test", "friendlyName": "Compliance Enforcement", "description": "Enforces regulatory access controls based on jurisdiction and data classification.", "status": "active", "activeVersion": 1, "snapshot": { "defaults": { "effect": "allow" }, "rules": [{ "id": "compliance-export-control", "status": "active", "priority": 100, "target": { "service": "data", "resource": "controlled/*", "action": "*" }, "when": { "op": "in", "path": "request.geo.country", "values": ["KP", "IR", "SY", "CU", "RU", "BY"] }, "thenEffect": { "type": "deny" }, "effect": { "type": "allow" }, "description": "Deny access to export-controlled data from sanctioned jurisdictions" }, { "id": "compliance-pii-restrict", "status": "active", "priority": 90, "target": { "service": "data", "resource": "pii/*", "action": "read" }, "when": { "op": "not", "condition": { "op": "eq", "path": "user.role", "value": "compliance-officer" } }, "thenEffect": { "type": "deny" }, "effect": { "type": "allow" }, "description": "Restrict PII access to compliance officers only" }], "metadata": { "reason": "Regulatory compliance — export controls and PII access restrictions" } } }
]
}
```
***
**Don't have a Govplane account yet? Get started right now for free!**
Start for free now →
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://govplane.gitbook.io/docs/documentation/resources/10-practical-governance-policies-for-production-saas-systems-with-ready-to-import-templates.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.