Policies & guardrails

Policy bounds authority

A policy states permitted actions, resource scope, limits, and approval requirements. The harness must enforce it independently of what the model says. The effective authority cannot exceed the Principal’s delegation grant.

The executable authorization checkenforces action and resource scope, grant expiry, revocation, Principal and agent matching, a task budget, and a tool-call limit. Download it and run:

python3 authorize.py
# ALLOW: logs.search on service-a
# DENY: deployments.rollback on service-a

Manage configuration through the UI, CLI, or Terraform, and enforce it in the runtime. For concurrent calls, reserve budget and usage atomically before execution. A check against the current spend alone cannot guarantee that an in-flight request stays within a cost ceiling.

Guardrails steer and verify quality

Guardrails define norms for the work itself. They can include source citation requirements, architecture rules, approved fixtures, structural tests, and linting. Use deterministic checks where practical, and make failing checks visible to the owner.

A policy may permit creating a report while a guardrail rejects that report for unsupported claims. Passing one does not imply passing the other.

Human approval is a bounded action

An approval should show the exact action, target, relevant input, and expected effect. Bind the decision to that proposal and a limited time window. If the proposal changes, request approval again. Do not treat approval for one write as permission for future writes.

Stop, terminate, revoke

Stopping a Task prevents new work. Terminating a Session ends a particular execution. Revoking a Delegation Grant removes authority. Operators need each control and a way to see its effect. Review queued calls, retries, and in-flight actions when defining stop behavior.

When authorization cannot be verified, deny the action and preserve enough context for a human to resolve the issue. Failure should be visible rather than quietly broadening access.

Make the safe path the easy path

Provide approved templates, read-only defaults, scoped connections, standard policies, and named owners. Teams should be able to configure their own workflows within enforceable organizational controls. Review policy changes as carefully as the code that enforces them.