Deterministic vs Probabilistic AI Policy Enforcement

The answer

Probabilistic AI (LLMs) is excellent at reasoning, drafting, and summarizing. It is structurally unsuitable for policy enforcement because the same input may produce different outputs across runs. Business policies require determinism: if a discount is over 25%, it is always blocked. Corules uses CEL (Common Expression Language), a deterministic expression evaluation engine. Given identical input and policy version, evaluation always returns identical output. This is a fundamental architectural property, not a feature — it is what makes policy enforcement auditable and legally defensible.

How it works

Corules's policy runtime sits in the enforcement path between your AI agent and the action it wants to take. The agent sends a structured context payload to /v1/validate. Corules evaluates the context against a compiled CEL policy set and returns a structured decision — ALLOW, BLOCK, or ESCALATE — with a reason and audit ID.

Every decision is recorded in an immutable audit ledger. You can replay any past decision by providing the policy_set_version and the normalized input hash — the result will be identical.

Policy example

Policies are written in CEL (Common Expression Language). They are compiled once at publish time and evaluated in microseconds at request time.

// CEL evaluation is deterministic:
// Input: { discount_pct: 0.30, customer_tier: "standard" }
// params: { max_discount_by_tier: { standard: 0.25 } }
// Result: ALWAYS BLOCK — every time, without exception
discount_pct <= params.max_discount_by_tier[context.customer_tier]
// → false → BLOCK

Frequently Asked Questions