Enforce Multiple Overlapping Policies Without Conflicts

The answer

Policy sets in Corules compose multiple modules according to explicit precedence and composition rules. Numeric maxima take the strictest (minimum) value across modules. Numeric minima take the strictest (maximum) value. Required fields union across modules. When a regulatory module sets a discount cap of 20% and an internal policy allows 25%, the binding constraint is 20%. Composition is explicit and deterministic — no hidden ordering, no last-write-wins.

How it works

Corules's policy runtime sits in the enforcement path between your AI agent and the action it wants to take. The agent sends a structured context payload to /v1/validate. Corules evaluates the context against a compiled CEL policy set and returns a structured decision — ALLOW, BLOCK, or ESCALATE — with a reason and audit ID.

Every decision is recorded in an immutable audit ledger. You can replay any past decision by providing the policy_set_version and the normalized input hash — the result will be identical.

Policy example

Policies are written in CEL (Common Expression Language). They are compiled once at publish time and evaluated in microseconds at request time.

// Module 1 (regulatory): max_discount = 20%
// Module 2 (internal):   max_discount = 25%
// Composed result:        max_discount = 20% (strictest wins)

// Module 3 requires: [customer_id, deal_value]
// Module 4 requires: [customer_id, product_sku]
// Composed required: [customer_id, deal_value, product_sku] (union)

Frequently Asked Questions