> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mergeguide.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies & frameworks

> Choose which policies run and scope your checks to the compliance frameworks you care about.

MergeGuide checks your code against **policies**. A compliance **framework** groups
the policies that satisfy a named standard. This page covers how to see what's
available, scope a check to a framework, and add your own policies.

## List available policies

To see the policies available to you:

```bash theme={null}
mergeguide policies
```

This lists the default policy set plus any custom policies MergeGuide loads from
your project. See [`mergeguide policies`](/reference/cli#mergeguide-policies).

## Use the defaults

By default, `check` runs MergeGuide's built-in policy set. You don't need to
configure anything to get coverage. The default config enables it:

```yaml .mergeguide/config.yaml theme={null}
policies:
  use_defaults: true
  custom_dir: .mergeguide/policies
```

To run a single check **without** the defaults — for example, to test a custom
policy in isolation — use `--no-defaults`:

```bash theme={null}
mergeguide check src/ --no-defaults --policy ./my-policy.yaml
```

## Scope a check to frameworks

When you activate one or more frameworks, MergeGuide runs only the rules mapped to
those frameworks. Scope a check from the CLI with `--frameworks`:

```bash theme={null}
# Only rules mapped to SOC 2 Type 2 or PCI DSS v4 will fire
mergeguide check src/ --frameworks soc2-type2,pci-dss-v4
```

Pass a comma-separated list of framework IDs. When you supply `--frameworks`, rules
that aren't mapped to at least one of them don't contribute findings. With no
`--frameworks`, the full default corpus runs.

<Note>
  The exact set of frameworks available to you depends on your plan and your
  organization's configuration. Open the **Compliance** area of the dashboard to see
  the frameworks active on your account. See [Compliance overview](/compliance/overview).
</Note>

## Add custom policies

`mergeguide init` creates a sample custom-policy file at
`.mergeguide/policies/custom.yaml`. Policies in your `custom_dir` load alongside
the defaults. A custom policy looks like this:

```yaml .mergeguide/policies/custom.yaml theme={null}
version: "1.0"

metadata:
  name: "Custom Policies"
  description: "Project-specific policy rules"

policies:
  - id: "example-rule"
    name: "Example Rule"
    description: "An example custom rule"
    severity: warning
    languages: ["*"]
    enabled: false   # set to true to enable
    rules:
      - pattern: "example_pattern"
        message: "This is an example violation"
        remediation: "Replace with the correct pattern"
```

You can also pass a policy file to a single check without putting it in
`custom_dir`:

```bash theme={null}
mergeguide check src/ --policy ./my-policy.yaml
```

Pass `--policy` more than once to load several files.

## Enable or disable specific policies

To turn individual policies on or off across a project without editing policy
files, list them in your config:

```yaml .mergeguide/config.yaml theme={null}
enabled_policies:
  - owasp-top-10
disabled_policies:
  - example-noisy-rule
```

See [Configuration keys](/reference/config-keys) for the full set of config keys.

## Next steps

<CardGroup cols={2}>
  <Card title="Thresholds" icon="gauge" href="/configuration/thresholds">
    Decide what severity blocks a commit or a merge.
  </Card>

  <Card title="Compliance overview" icon="clipboard-check" href="/compliance/overview">
    How frameworks map to audit evidence.
  </Card>
</CardGroup>