Configure Assessment and Monitoring Policy

Configure Assessment Policy before you create production Assessments. The active policy selects Dockt compliance packages and combines them with Workspace rules and supported adjustments to individual package rules.

This guide configures the Belgian construction package, requires every worker to be at least 18 years old, requires a VCA certificate for the package’s basic safety rule, and enables periodic monitoring.

You also configure uploaded proof for Job Profile qualifications. This requires a certificate for the accepted qualification, beyond requiring a document type.

Prerequisites

You need a workspace credential with these permissions:

• workspace-configuration:read
• assessment-policy:write
• monitoring-policy:write

Export the API base URL and bearer token:

export DOCKT_API_BASE_URL='https://api.dockt.com'
export DOCKT_API_TOKEN='REPLACE_WITH_BEARER_TOKEN'

The examples use curl and jq.

1. Read the active configuration and catalog

Read the overview to confirm which policy revision and monitoring version are active:

curl --fail-with-body --silent --show-error \
  -H "Authorization: Bearer $DOCKT_API_TOKEN" \
  "$DOCKT_API_BASE_URL/v1/workspace-configuration" | jq '.data'

Read the authoring catalog before you build commands:

catalog_response="$(
  curl --fail-with-body --silent --show-error \
    -H "Authorization: Bearer $DOCKT_API_TOKEN" \
    "$DOCKT_API_BASE_URL/v1/policy-authoring-catalog"
)"

printf '%s' "$catalog_response" | jq '.data | {
  policy_language_version,
  version,
  rule_templates,
  qualification_comparison_presets,
  assurance_levels
}'

Use the returned fact codes, evidence types, Qualification Definition IDs, and comparison presets unchanged. The API rejects commands that use values outside the catalog.

2. Create a policy draft

Read the active policy revision, then create a draft from it:

active_policy_response="$(
  curl --fail-with-body --silent --show-error \
    -H "Authorization: Bearer $DOCKT_API_TOKEN" \
    "$DOCKT_API_BASE_URL/v1/assessment-policy"
)"

active_revision="$(printf '%s' "$active_policy_response" | jq -r '.data.revision')"

policy_response="$(
  curl --fail-with-body --silent --show-error \
    -X POST "$DOCKT_API_BASE_URL/v1/assessment-policy/drafts" \
    -H "Authorization: Bearer $DOCKT_API_TOKEN" \
    -H 'Content-Type: application/json' \
    --data "{\"expected_active_revision\":$active_revision}"
)"

export DOCKT_POLICY_REVISION_ID="$(printf '%s' "$policy_response" | jq -r '.data.id')"
export DOCKT_POLICY_LOCK_VERSION="$(printf '%s' "$policy_response" | jq -r '.data.lock_version')"

If a draft already exists, this operation returns that draft. Review its contents before you continue because it may contain another author’s changes.

3. Select compliance packages

Set the complete package list for the draft. This example selects the Belgian construction package:

policy_response="$(
  curl --fail-with-body --silent --show-error \
    -X POST \
    "$DOCKT_API_BASE_URL/v1/assessment-policy/revisions/$DOCKT_POLICY_REVISION_ID/commands" \
    -H "Authorization: Bearer $DOCKT_API_TOKEN" \
    -H 'Content-Type: application/json' \
    --data "$(jq -n \
      --argjson lock "$DOCKT_POLICY_LOCK_VERSION" \
      '{
        expected_lock_version: $lock,
        command: {
          kind: "set_compliance_packages",
          package_codes: ["social_construction_be_v1"]
        }
      }')"
)"

export DOCKT_POLICY_LOCK_VERSION="$(printf '%s' "$policy_response" | jq -r '.data.lock_version')"

The command replaces the draft’s package selection. You can select more than one package, but their atomic rules remain independent. Dockt doesn’t automatically merge similar requirements from different packages.

4. Add a Workspace rule

Require a worker age of at least 18 with the catalog’s worker.age_at_evaluation fact:

policy_response="$(
  curl --fail-with-body --silent --show-error \
    -X POST \
    "$DOCKT_API_BASE_URL/v1/assessment-policy/revisions/$DOCKT_POLICY_REVISION_ID/commands" \
    -H "Authorization: Bearer $DOCKT_API_TOKEN" \
    -H 'Content-Type: application/json' \
    --data "$(jq -n \
      --argjson lock "$DOCKT_POLICY_LOCK_VERSION" \
      '{
        expected_lock_version: $lock,
        command: {
          kind: "upsert_minimum_fact_rule",
          rule_code: "minimum_worker_age",
          label: "Worker must be at least 18",
          fact: "worker.age_at_evaluation",
          minimum: 18,
          enforcement: "required"
        }
      }')"
)"

export DOCKT_POLICY_LOCK_VERSION="$(printf '%s' "$policy_response" | jq -r '.data.lock_version')"

This rule applies to every Assessment in the Workspace. A known age below 18 makes the rule unmet. Missing information leaves the rule unresolved; it doesn’t silently pass.

5. Strengthen one package rule

Require an uploaded VCA certificate in addition to the evidence already accepted by the Belgian package’s basic safety rule:

policy_response="$(
  curl --fail-with-body --silent --show-error \
    -X POST \
    "$DOCKT_API_BASE_URL/v1/assessment-policy/revisions/$DOCKT_POLICY_REVISION_ID/commands" \
    -H "Authorization: Bearer $DOCKT_API_TOKEN" \
    -H 'Content-Type: application/json' \
    --data "$(jq -n \
      --argjson lock "$DOCKT_POLICY_LOCK_VERSION" \
      '{
        expected_lock_version: $lock,
        command: {
          kind: "require_additional_document",
          target: {
            source: "compliance_package",
            source_id: "social_construction_be_v1",
            rule_code: "construction_basic_safety_training"
          },
          document_type: "vca_certificate",
          reason: "Site access requires a certificate copy."
        }
      }')"
)"

export DOCKT_POLICY_LOCK_VERSION="$(printf '%s' "$policy_response" | jq -r '.data.lock_version')"

The target must appear in the catalog’s rule_override_capabilities, and the requested operation must be allowed for that target. A weakening adjustment or waiver requires a reason and remains visible in Decision lineage.

6. Require uploaded proof for Job Profile qualifications

To require an uploaded certificate for each accepted Job Profile qualification, enable the policy-wide setting on the draft:

policy_response="$(
  curl --fail-with-body --silent --show-error \
    -X POST \
    "$DOCKT_API_BASE_URL/v1/assessment-policy/revisions/$DOCKT_POLICY_REVISION_ID/commands" \
    -H "Authorization: Bearer $DOCKT_API_TOKEN" \
    -H 'Content-Type: application/json' \
    --data "$(jq -n \
      --argjson lock "$DOCKT_POLICY_LOCK_VERSION" \
      '{
        expected_lock_version: $lock,
        command: {
          kind: "set_job_profile_qualification_uploads",
          required: true
        }
      }')"
)"

export DOCKT_POLICY_LOCK_VERSION="$(printf '%s' "$policy_response" | jq -r '.data.lock_version')"

The command sets require_job_profile_qualification_uploads to true. This setting defaults to false for new policies. In the Dockt dashboard, its label is Require uploaded proof for job-profile qualifications. The setting becomes effective after activation.

For example, if a Job Profile requires the exact VOL-VCA qualification, an uploaded BASIC-VCA certificate leaves its proof requirement incomplete, even if a registry confirms that the worker holds VOL-VCA. These are different qualifications. The document-type rule in step 5 requires a VCA certificate but does not require it to match the Job Profile qualification.

Use required: false to stop applying the policy-wide constraint. Explicit uploaded_proof_required: true flags on individual qualification rules remain effective. The setting does not change which rules apply or how alternatives are evaluated. Advisory and waived rules do not block the Decision.

7. Preview the effective policy

Preview the complete draft before activation:

preview_response="$(
  curl --fail-with-body --silent --show-error \
    -X POST \
    "$DOCKT_API_BASE_URL/v1/assessment-policy/revisions/$DOCKT_POLICY_REVISION_ID/preview" \
    -H "Authorization: Bearer $DOCKT_API_TOKEN"
)"

printf '%s' "$preview_response" | jq '.data | {
  valid,
  require_job_profile_qualification_uploads,
  issues,
  effective_rule_count,
  applied_adjustment_count,
  effective_rules,
  applied_adjustments
}'

Don’t activate the draft unless valid is true. Review applied_adjustments to confirm that every change has the intended direction and reason.

8. Activate the policy revision

Activate the draft with its current lock version:

curl --fail-with-body --silent --show-error \
  -X POST \
  "$DOCKT_API_BASE_URL/v1/assessment-policy/revisions/$DOCKT_POLICY_REVISION_ID/activate" \
  -H "Authorization: Bearer $DOCKT_API_TOKEN" \
  -H 'Content-Type: application/json' \
  --data "{\"expected_lock_version\":$DOCKT_POLICY_LOCK_VERSION}" | \
  jq '.data | {id, revision, status, require_job_profile_qualification_uploads, compliance_packages, activated_at}'

Activation repeats validation, makes the revision immutable, and reevaluates active Assessments in the Workspace. Earlier Decisions keep the policy lineage under which they were created.

9. Configure periodic monitoring

Set a 24-hour interval and a maximum monitoring duration of 180 days:

curl --fail-with-body --silent --show-error \
  -X PUT "$DOCKT_API_BASE_URL/v1/monitoring-policy" \
  -H "Authorization: Bearer $DOCKT_API_TOKEN" \
  -H 'Content-Type: application/json' \
  --data '{
    "mode": "periodic",
    "interval_hours": 24,
    "max_duration_days": 180
  }' | jq '.data'

interval_hours must be from 1 through 8760. max_duration_days must be from 1 through 3650. To disable Workspace monitoring, replace the policy with:

{
  "mode": "disabled"
}

Monitoring changes recalculate eligible Assessment schedules without invalidating current Decisions. Configure delivery of material reassessment changes through Notification Destinations and Routes, not through Monitoring Policy.

You can now complete an Assessment under the active Workspace policy.