Policy templates use {{variable_name}} placeholders that are automatically replaced when rendering a policy preview or generating a PDF. Missing values appear as highlighted [VARIABLE NAME] markers in draft previews so you can easily identify what needs attention.
How Variables Work
Auto-Resolution
When you preview or download a policy, LowerPlane fetches your organization details, security roles, and active integrations to fill in placeholders automatically.
Manual Overrides
Any auto-resolved value can be overridden per-policy via the policy editor metadata. Overrides take precedence over auto-resolved values.
Missing Value Handling
Unresolved placeholders appear as [VARIABLE NAME] highlighted in yellow during draft preview. In approved documents and PDFs, they appear as plain text without highlighting.
Organization Variables
These are resolved from your organization settings (Settings page).
| Variable | Description | Source |
|---|
{{company_name}} | Your organization name | Organization settings |
{{organization_name}} | Alias for company_name | Organization settings |
{{legal_name}} | Legal entity name | Organization settings |
{{organization_legal_name}} | Alias for legal_name | Organization settings |
{{organization_logo}} | Organization logo URL | Organization settings |
Framework & Integration Variables
| Variable | Description | Example Value |
|---|
{{applicable_frameworks}} | Comma-separated list of enabled frameworks | ”SOC 2, ISO 27001, HIPAA” |
{{cloud_providers}} | Active cloud integrations | ”AWS, GCP, Azure” |
Date & Version Variables
These are set automatically and always have values.
| Variable | Description | Default |
|---|
{{effective_date}} | Today’s date | Current date (YYYY-MM-DD) |
{{review_date}} | One year from today | Today + 1 year (YYYY-MM-DD) |
{{policy_version}} | Current policy version number | 1 |
{{version}} | Alias for policy_version | 1 |
Security & Compliance Defaults
These always have hardcoded defaults and will never show as missing. Override them per-policy if your organization uses different values.
| Variable | Default Value | Description |
|---|
{{classification}} | Internal | Document classification level |
{{scope_exclusions}} | None at this time | Scope exclusions statement |
{{availability_target}} | 99.9 | System availability target (%) |
{{data_retention_period}} | 7 years | Default data retention period |
{{review_frequency}} | annually | Policy review frequency |
{{incident_response_time}} | 4 hours | Incident response SLA |
{{backup_frequency}} | daily | Backup schedule |
{{password_min_length}} | 12 | Minimum password length |
{{password_expiry_days}} | 90 | Password expiration period |
{{mfa_enforcement}} | all users | MFA enforcement scope |
{{session_timeout_minutes}} | 30 | Session timeout duration |
Security Role Variables
These are resolved from your Security Roles assignments (Personnel > Security Roles). If a role is assigned to a person, their full name is used. If not assigned, the variable shows as a highlighted placeholder.
| Variable | Resolved From |
|---|
{{ciso_name}} | CISO or Chief Information Security Officer role |
{{dpo_name}} | DPO or Data Protection Officer role |
{{cto_name}} | CTO or Chief Technology Officer role |
{{ceo_name}} | CEO or Chief Executive Officer role |
{{security_officer_name}} | Security Officer role |
{{privacy_officer_name}} | Privacy Officer role |
{{compliance_officer_name}} | Compliance Officer role |
{{it_manager_name}} | IT Manager role |
{{risk_manager_name}} | Risk Manager role |
{{hr_manager_name}} | HR Manager role |
{{incident_response_lead}} | Incident Response Lead role |
{{system_administrator_name}} | System Administrator role |
Custom security roles are also supported. Any role added to Security Roles automatically generates a variable using the pattern: role name in lowercase with spaces replaced by underscores, followed by _name. For example, Network Engineer becomes {{network_engineer_name}}.
Overriding Variables Per-Policy
You can override any auto-resolved variable for a specific policy:
- Open the policy in the editor
- Go to Policy Settings or Metadata
- Add custom placeholder values
- These overrides take precedence over the auto-resolved defaults
Common overrides include data_retention_period (some policies require different retention than the default), review_frequency (critical policies may need quarterly review), and classification (some policies are “Confidential” rather than “Internal”).
Missing Value Display
| Context | How Missing Values Appear |
|---|
| Draft Preview | [VARIABLE NAME] with yellow highlight background |
| Approved Document | [VARIABLE NAME] as plain text (no highlight) |
| PDF Download | [VARIABLE NAME] as plain text |
Review your policy preview before submitting for approval. Highlighted placeholder markers indicate missing values that should be filled in — either by assigning the relevant security role or by adding a manual override.
