Add an industry pack to your app

Turn on the payments, healthcare, insurance, finance or education pack, see what it adds, and check the controls it makes checkable.

Planned for 1.2

Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.

Stability The promise an interface ships with.

Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
Beta Usable in production; may change before it becomes stable.
Experimental May change or go away; needs an explicit opt-in in main.yaml.

Stability levels

View as Markdown Open in Claude Edit

Updated 2026-10-28

You will switch on a pack, read what it adds, and run its controls. It takes about 15 minutes. A pack makes controls checkable; it is not a certification.

You need

A MainSDK app with a main.yaml.

1. Name the pack

main.yaml

industry: payments

Packs are signed bundles delivered through delivery.packs; run npx mainsdk sync to fetch them. Without delivery, a packs/payments/ folder in the project is read instead. A pack can only tighten the baseline: it adds forbid policies, refusals and requirements, never a permission.

2. See what it adds

npx mainsdk explain config lists each policy, label rule, allowed driver and control the pack adds, with packs/payments@1.0.0 as its source.

3. Check and assure

npx mainsdk check reports each broken rule with the control it maps to, such as PCI DSS 4.0.1 requirement 3.2.1 for a field labelled pan, with the fix "use hosted fields". For PCI DSS 6.4.3 and 11.6.1, list your payment pages and approved scripts:

main.yaml

compliance:
  pages: [checkout.html]
  scripts:
    - { host: js.stripe.com, reason: Hosted fields, owner: payments }

npx mainsdk assure --standard pci-dss-4.0.1 fails 6.4.3 with the host of any script not on the list, and raises an 11.6.1 alert when a payment page changes from its recorded hash. --accept-pages records the current pages as the new baseline.

4. Write your own

A pack is a folder of pack.yaml, labels.yaml, evidence.yaml and policies/*.cedar. npx mainsdk pack build packs/mine --out mine.json checks that it only tightens, uses canonical labels and maps each control to a pinned standard version and an SCF control, then writes the bundle.

Check it worked

Run npx mainsdk check --json and find the pack gate. Every pack also adds the sentence "This pack makes controls checkable; it is not a certification." to the launch report.

Was this page helpful?