Technology · Discipline

Policy-as-code enforcement

Policy in my governance platform is enforced by hooks, not remembered by prompts: a lead cannot edit an artifact, work cannot dispatch before its evidence exists, a hook may never report an operation that did not happen.

One Rust binaryAgentOS governanceHooks inside the coding tools
One agent session
Refused · before a tool call This work order is ratified and locked. Next move: the human operator may unlock it.
  • ~100hook modules served by one binary
  • 11lifecycle events where policy runs
  • 63shell hooks it replaced, ported with tests

Rules moved out of the prompt and into the runtime

In AgentOS I found that long agent runs fail because the agent is asked to remember the rules along with everything else. I moved the rules out of the agent and into code that runs inside its runtime, in the hook points the agent cannot route around. The coding tools I govern expose lifecycle hooks, before a tool call, after one, at session start, when the agent tries to stop. One Rust binary serves all of them. The diagnosis is in Why long agent runs fail.

A publisher writes the hook configuration into each agent environment and checks it byte for byte, so the rules that run are the rules I wrote.

Approved by me
In each agent environment one differing byte fails the publish

What the hooks enforce

The effects are what matter.

Attempts inside the agent runtime
Edit a ratified work orderlocked · operator only
Write outside the assigned pathsconfined
Lead retypes a teammate's artifactpass it on instead
Dispatch before the evidence existsrefused
Stop with work outstandingsent back to the work
Message another agentthrough the guarded channel
Bypass a rule with a reason and an expiryleaves a policy event
the hook

A refusal can only point to a command that exists for that agent in its current state, and it names who may take it, so an agent that hits a wall learns its next correct move. I reworked every refusal path to get that property. Overrides exist, because a system with no override gets bypassed.

I turn an operating procedure into enforcement an autonomous agent cannot ignore, and I phrase each refusal so it teaches the next correct step.

Incidents become machine checks

The approach reaches the build too: an incident becomes a permanent machine check, so the same mistake is caught by the build from then on.

A test wrote synthetic rows into the real databaseEvery test's source scanned for connections✓
A test opens a connection from the approved listbuilds
A test opens a connection anywhere elsebuild fails
the source scan

The hook points belong to the vendors' coding tools; the policy engine and its rules are mine.