Skip to content
Trust plane

Policy outside agent code

Security and governance are boundary contracts, not prompt instructions. Policy bundles (JsonLogic) are evaluated deterministically; native ActionRisk is checked per dimension; v1 approval modes remain compatibility projections; OTEL traces and evaluators make observable runs replayable and scorable.

Abstract ContextOS trust visual showing policy boundary, approval gates, evaluator panels, trace rails, and replay records outside the agent loop.
Runtime trust boundary

Policy, approvals, evaluation, traces, and replay sit outside model code, so every risky action crosses a deterministic boundary.

Policy EngineActionRiskv1 modeEvaluatorReplay
Trust outside the model
  1. 01Policy Engine

    Evaluates rules at compiler, critic, and tool boundaries.

  2. 02ActionRisk

    Evaluate effect, authority, reversibility, interaction, and data scope independently.

  3. 03Identity

    Propagates user delegation and agent workload identity.

  4. 04Evaluators

    Score safety, utility, cost, latency, and compliance.

  5. 05Replay record

    Keeps evidence, controls, approvals, and trace handles.

Native risk, compatible modes

ActionRisk is the native multidimensional model. read_only, local_write, network, delegated, and destructive remain the v1 projection and safety ceiling.

Anti-pattern prevented

Model self-policing: security must not depend on the model. The Policy Engine is the deterministic boundary; the model proposes, the boundary decides.

evaluators

Policy compliance · Utility · Latency · Safety · Economics. Tracked per intent, per tenant, per pack version; deltas gate every release.

Policy bundle (JsonLogic) outside agent code

Policy is authored, versioned, and evaluated at the boundary; a deployment may also require supply-chain signatures. The Compiler, Critic, and Tool Gateway all consult the Policy Engine at the right runtime checkpoint.

Rule — refunds above INR 3000 require finance approval
{
  "rule_id": "R_HIGH_VALUE_REQUIRES_APPROVAL",
  "applies_to": { "intent": "support.refund" },
  "if": {
    "and": [
      { "==": [{ "var": "user.role" }, "support_agent"] },
      { ">": [{ "var": "request.context.refund_amount" }, 3000] }
    ]
  },
  "then": {
    "allow": true,
    "approval_mode": "destructive",
    "requires_approval_gate": "GATE_FINANCE_APPROVAL",
    "arg_constraints": {
      "refund_amount": { "max": 3000, "unless_approved": true },
      "currency": { "enum": ["INR"] }
    }
  },
  "decision_binding": "support.refund.execute"
}