feat(examples): add UK regulatory policy pack (UK GDPR, ICO ADM, FCA)

[dannyyol]

Description

Adds a UK regulatory policy pack to examples/policies/uk-regulatory/, following the same pattern established by the African regulatory pack (#3077) and India regulatory pack (#3123).

The UK is a major regulated AI-agent market (financial services, public sector, healthcare) and had no jurisdiction-specific coverage in AGT yet. This PR adds starter Policy-as-Code examples that govern what an AI agent is allowed to do under UK law, evaluated at the agent action/output boundary with allow, audit, escalate, or deny decisions and statutory citations on each rule.

Three policy files

File	Coverage	Authority
uk-gdpr-data-protection.yaml	UK GDPR + DPA 2018 — breach notification when likely to pose risk (72h to ICO; Art. 34 if high risk), security safeguards, purpose limitation, special category data, restricted transfers (escalate for review; deny without adequacy/safeguards; DUAA "not materially lower" test), complaints procedure (DPA 2018 s.164A)	ICO
ico-automated-decisions.yaml	UK GDPR Arts. 22A–22D (DUAA 2025 s.80) — Art. 22C safeguards, Art. 22B special-category ADM, agentic orchestration steps, recruitment ADM	ICO
fca-financial-conduct.yaml	Consumer Duty (PRIN 2A), SM&CR accountability, AI-influenced pricing/communications (principles-based — no AI-specific binding rules as of 2026)	FCA

Also included

• OPA Rego reference implementations in rego/ (not loaded by the Agent-OS Python runtime; provided for OPA-based pipelines, mirroring feat(examples): add African regulatory policy pack (NDPA, CBN, POPIA, Kenya DPA) #3077 and feat(examples): add India regulatory policy pack (DPDP, CERT-In, RBI, SEBI, Aadhaar) #3123)
• 41 OPA unit tests + rego/run_tests.sh (goes beyond feat(examples): add India regulatory policy pack (DPDP, CERT-In, RBI, SEBI, Aadhaar) #3123 which shipped without in-repo tests; aligns with feat(examples): add African regulatory policy pack (NDPA, CBN, POPIA, Kenya DPA) #3077's Rego test coverage approach)
• GB entry wired into the shared jurisdiction router in african-regulatory/rego/jurisdiction-router.rego
• Pack README with coverage table, known gaps, and disclaimers

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

• agent-os-kernel
• agent-mesh
• agent-runtime
• agent-sre
• agent-governance
• docs / root

Checklist

• My code follows the project style guidelines (matches the existing regulatory-pack format)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (opa test — 41/41 pass via rego/run_tests.sh)
• I have updated documentation as needed
• I have signed the Microsoft CLA

Test plan

• Run ./examples/policies/uk-regulatory/rego/run_tests.sh — expect 41/41 PASS
• Validate YAML policies (from repo root with agent-governance-python installed):

  python -m agent_os.policies.cli validate examples/policies/uk-regulatory/*.yaml
  
  opa eval \
  -d examples/policies/african-regulatory/rego/ \
  -d examples/policies/uk-regulatory/rego/ \
  -i '{"context": {"customer_country": "GB"}}' \
  "data.agt_policies.router.applicable_policies"
  

[github-actions]

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

[github-actions]

🤖 AI Agent: test-generator — `examples/policies/uk-regulatory/fca-financial-conduct.yaml`

AI-generated review output. Treat it as untrusted analysis and verify before acting.

examples/policies/uk-regulatory/fca-financial-conduct.yaml

• test_fca_consumer_harm_deny -- Validate denial of outputs that mislead customers or exploit vulnerabilities.
• test_fca_fair_value_bypass_deny -- Ensure outputs bypassing fair value assessments are denied.
• test_fca_accountability_delegation_deny -- Verify denial of outputs delegating accountability to AI or algorithms.
• test_fca_pricing_decision_audit -- Confirm audit logging for AI-influenced pricing or eligibility decisions.
• test_fca_customer_communication_audit -- Validate audit logging for AI-influenced customer communications.

examples/policies/african-regulatory/rego/jurisdiction-router.rego

• test_gb_policy_routing -- Ensure GB routes to uk_gdpr, ico_adm, and fca_conduct policies correctly.

[github-actions]

🤖 AI Agent: code-reviewer — Action items:

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 1 warning. The PR introduces a UK regulatory policy pack with comprehensive coverage and tests, but there is a potential gap in the validation of YAML policy files.

#	Sev	Issue	Where
1	⚠️	Lack of explicit validation for YAML policy files in CI	examples/policies/uk-regulatory/*.yaml

Action items:

1. None.

Warnings (fine as follow-up PRs):

#	Issue	Where
1	Add explicit CI validation for YAML policy files to ensure they conform to the expected schema and avoid runtime errors.	examples/policies/uk-regulatory/*.yaml

[github-actions]

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

Documentation is in sync.

[github-actions]

🤖 AI Agent: contributor-guide — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Welcome, and thank you for contributing! Great job on providing detailed documentation and comprehensive test coverage for the UK regulatory policy pack.

Before merging, please address the following:

1. Ensure the Microsoft CLA is signed as noted in your checklist.
2. Update examples/policies/README.md to include the new uk-regulatory/ policy pack in the Policy Packs table.

Refer to CONTRIBUTING.md for guidance. Let us know if you have any questions!

[github-actions]

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

No breaking changes detected.

[dannyyol]

@dannyyol please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[dannyyol]

@dannyyol please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

[imran-siddique]

Thanks for the thorough pack — the Rego side is solid (41/41 OPA tests, GB wired into the shared jurisdiction router with an India-preservation regression test, and clear per-file disclaimers). One blocking issue on the YAML side.

action: escalate is not a valid PolicyAction and will fail PolicyDocument.from_yaml().

agent-governance-python/agent-os/src/agent_os/policies/schema.py defines:

class PolicyAction(str, Enum):
    ALLOW = "allow"
    DENY = "deny"
    AUDIT = "audit"
    BLOCK = "block"

There is no escalate. PolicyRule.action is typed as PolicyAction, and from_yaml() does yaml.safe_load(...) → cls.model_validate(data), so loading any of these YAMLs raises a pydantic ValidationError. Affected rules (7):

• uk-gdpr-data-protection.yaml: ukgdpr-purpose-limitation-escalate, ukgdpr-special-category-health, ukgdpr-special-category-general, ukgdpr-bulk-export-escalate, ukgdpr-cross-border-language-escalate, ukgdpr-cross-border-action-escalate
• ico-automated-decisions.yaml: adm-recruitment-decision-escalate

The India (dpdp-data-protection.yaml) and African (popia-south-africa.yaml) packs you're modelling on deliberately use action: block for exactly this review/hold tier — none of them use escalate. That's why opa test is green (Rego defines its own independent escalate decision, unconstrained by the Python enum) while the YAML path is broken, and it's masked because CI doesn't run the YAML validator. Consistent with this, your own test-plan checkbox python -m agent_os.policies.cli validate examples/policies/uk-regulatory/*.yaml is unchecked — that step will currently fail.

Requested change: switch the 7 action: escalate rules to action: block to match the schema and the sibling packs, then run the validate command to confirm all three YAMLs load. The Rego escalate tier can stay as-is (schema-independent). The FCA YAML already uses only deny/audit/block and is fine. Happy to re-review once this is in.

[MohammadHaroonAbuomar]

Citation and scope corrections:

• fca-financial-conduct.rego:52 and the yaml: PRIN 2A.1 -> PRIN 2A.4 (fair-value outcome is 2A.4).
• uk-gdpr-data-protection.rego:49, yaml, and README: drop or scope DPA 2018 s.67. That is Part 3 (law-enforcement processing) only and conflates regimes when applied to general processing.
• Remove "AU" from adequacy_countries; Australia is not on the UK adequacy list.
• Drop unused lawful_basis_documented from the input-schema comment.
• CLA check is still pending.

[dannyyol]

Thanks @imran-siddique and @MohammadHaroonAbuomar for the review, I've addressed the requested changes in the latest commit.

@imran-siddique — YAML schema

Replaced all 7 action: escalate rules with action: block in uk-gdpr-data-protection.yaml (6 rules) and ico-automated-decisions.yaml (adm-recruitment-decision-block)
Renamed the affected rule IDs from *-escalate to *-block for consistency with the sibling packs
Rego escalate tiers are unchanged (schema-independent, as suggested)
@MohammadHaroonAbuomar — citation and scope

PRIN 2A.1 → PRIN 2A.4 in fca-financial-conduct.yaml and fca-financial-conduct.rego
Removed DPA 2018 s.67 from general breach-notification citations (YAML, Rego, and pack README); general processing now cites UK GDPR Art. 33 only
Removed "AU" from adequacy_countries in uk-gdpr-data-protection.rego
Removed unused lawful_basis_documented from the Rego input-schema comment

[dannyyol]

@microsoft-github-policy-service agree

[MohammadHaroonAbuomar]

• DCO failing on merge commit d680879 (no Signed-off-by trailer); sign the merge or rebase instead of merge-from-main
• Spell-check changed files failing (run 28923597705); add flagged term(s) to .cspell-repo-terms.txt

[dannyyol]

Thank you @MohammadHaroonAbuomar
The DCO failing and Spell-check changed files failing are now fixed

[dannyyol]

@MohammadHaroonAbuomar Please can you review the changes.

[imran-siddique]

The escalate-to-block schema fix and the citation corrections (PRIN 2A.4, s.164A, AU removal) are all in, and the YAMLs validate against the canonical schema.