# Runtime policy enforcement

The pre-action decision and enforcement layer that evaluates identity, purpose, risk tier, tool, resource, data class, limits, approval state, and current evidence before allowing an agent action.

core-concept · Security & governance · maturing · Reviewed 2026-08-09

## Definition

The pre-action decision and enforcement layer that evaluates identity, purpose, risk tier, tool, resource, data class, limits, approval state, and current evidence before allowing an agent action. A policy observed after action is audit. A policy checked before effect is control.

Distributed policy engines are established; agent-aware decision inputs and enforcement points are emerging.

## Why it matters

A policy observed after action is audit. A policy checked before effect is control.

The operating shift is from “Post-hoc policy review” to “Policy at every action boundary.”

## System anatomy

- **Practice 1:** Keep the policy decision outside the acting agent
- **Practice 2:** Version policy and record every decision input and result
- **Practice 3:** Fail closed when authority, evidence, or policy state is unavailable



## Important distinctions

- **Post-hoc policy review:** This concept moves the engineering system toward policy at every action boundary.



## Implementation signals

- Keep the policy decision outside the acting agent
- Version policy and record every decision input and result
- Fail closed when authority, evidence, or policy state is unavailable

## Failure modes

- Detailed policy logs with no enforcement point
- Stale or unreachable policy silently causing fail-open behavior



## Related knowledge

- [Observability & control](https://aisdlc.ai/agentic-engineering/observability-control) — The combined telemetry and enforcement architecture for tracing agent behavior, evaluating policy, obtaining approval, constraining action, revoking authority, quarantining execution, and stopping systems.
- [Deterministic containment](https://aisdlc.ai/agentic-engineering/deterministic-containment) — The enforcement envelope outside the model: isolation, deny-by-default access, typed allowlists, quotas, transaction ceilings, network boundaries, timeouts, rollback, quarantine, and tested stop controls.
- [Evidence engineering](https://aisdlc.ai/agentic-engineering/evidence-engineering) — The design of versioned, queryable evidence linking requirements, decisions, implementations, tests, evaluations, approvals, deployments, runtime signals, and lifecycle actions.

## Sources and further study

- [Open Policy Agent — OPA Management APIs and Architecture](https://www.openpolicyagent.org/docs/management-introduction) — An established policy-engine architecture for distributed enforcement, centrally managed policy bundles, decision logs, and enforcement telemetry. **Use:** Standard or protocol. **Limitation:** A specification defines an interface or control pattern; conformance alone does not establish authorization, security, or fitness for a use case.
- [NIST CAISI — Challenges in monitoring deployed AI systems](https://www.nist.gov/publications/challenges-monitoring-deployed-ai-systems-center-ai-standards-and-innovation) — A current view of monitoring needs and limitations for deployed AI systems. **Use:** Official guidance. **Limitation:** Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.
- [Microsoft Agentic Center of Excellence — Govern agents by risk](https://learn.microsoft.com/en-us/agents/center-of-excellence/govern-agents-risk) — Current enterprise guidance for matching review depth, autonomy limits, release gates, logging, and incident planning to agent risk. **Use:** Official guidance. **Limitation:** Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment.

---

This library synthesizes cited research, standards, official documentation, and clearly attributed practitioner perspectives. Maturity describes the state of a concept—not vendor endorsement, production readiness, or permission to deploy. Benchmarks and demonstrations do not replace use-case evaluation, governed controls, independent verification, or named human release authority.