> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy.md).

# Set Program Policy

The tenant-wide rules the loop follows — the remediation agent, fix recognition, license policy, remediation routing, SLOs, trusted domains, and ticket status.

**Administration → Program** is where an **Administrator** sets the rules the loop follows. Where [Workflows](/mrecEO40m5D6bt7Pq5pE/operate/workflows.md) automate the *actions* and [Connection Mapping](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/organization-model.md) records *who owns what*, Program sets the *policy* underneath both — which licenses are allowed, how the remediation agent behaves, who new remediations route to, and how fast each finding must be fixed.

{% hint style="info" %}
Changing anything on this page requires the **Administrator** role. An **Administrator (read-only)** can view it but can't make changes.
{% endhint %}

{% hint style="info" %}
Almost every Program policy takes effect on **newly discovered** findings and remediations. Changing a policy doesn't retroactively re-assign, re-ticket, or re-open work that already has an owner — with the exception of SLOs and license policy, which re-evaluate existing findings (each page says which).
{% endhint %}

## In this section

**Program** has nine sub-tabs: **Agent**, **Fix Recognition**, **License Policy**, **Remediations**, **Routing Policies**, **Service Level Objectives**, **Ticket Status**, **Approved Countries** and **Trusted Domains**. Remediations and Routing Policies are both covered by *Remediation Assignment and Routing* below.

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Remediation Agent</strong></td><td>The PR template the agent uses, and whether a ticket is required before Fix Now.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/remediation-agent.md">Remediation Agent</a></td></tr><tr><td><strong>Remediation Assignment and Routing</strong></td><td>Who a new remediation is assigned to — simple defaults and advanced code-defined routing.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/remediation-assignment-and-routing.md">Remediation Assignment and Routing</a></td></tr><tr><td><strong>Fix Recognition</strong></td><td>Credit the developers who fix vulnerabilities, with a comment on the pull request.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/fix-recognition.md">Fix Recognition</a></td></tr><tr><td><strong>License Policy</strong></td><td>Allow or deny each open-source license.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/license-policy.md">License Policy</a></td></tr><tr><td><strong>Service Level Objectives</strong></td><td>The remediation clock — how long each finding has before it's overdue.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/service-level-objectives.md">Service Level Objectives</a></td></tr><tr><td><strong>Trusted Domains</strong></td><td>Domains you approve as safe, lowering the risk of agent files that reference them.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/trusted-domains.md">Trusted Domains</a></td></tr><tr><td><strong>Approved Countries</strong></td><td>The countries you expect Git activity from, per GitHub organization.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/approved-countries.md">Approved Countries</a></td></tr><tr><td><strong>Ticket Status</strong></td><td>Every ticket Heeler has created and its current sync state.</td><td><a href="/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/ticket-status.md">Ticket Status</a></td></tr></tbody></table>

## Worked example

See this inside a full SLO-driven program:

{% content-ref url="/pages/qXynZJ6ysecRvAHjNFOM" %}
[Run an SLO-Driven AppSec Program](/mrecEO40m5D6bt7Pq5pE/solutions-and-use-cases/run-an-slo-driven-appsec-program.md)
{% endcontent-ref %}

## Related

* [Operate](/mrecEO40m5D6bt7Pq5pE/operate.md) — the dashboards, workflows, and SLOs these policies drive.
* [Fix](/mrecEO40m5D6bt7Pq5pE/fix.md) — how the remediation agent turns these policies into pull requests.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.