Policy-as-Code for AI Agent Workflows

The answer

Policy-as-code for AI agents means expressing business rules, compliance constraints, and escalation thresholds as version-controlled, machine-executable code — and evaluating every AI-proposed action against that code at runtime, before execution. The key properties that make this work: (1) determinism — the same input and policy version always produce the same output; (2) compile-time validation — policy expressions are validated when they are authored, not when they evaluate a real decision; (3) parameter separation — policy logic and tenant-specific values are stored separately, so changing a discount cap does not require a code change; (4) version control — every published policy set is versioned, and historical decisions remain linked to the version that governed them. Corules uses CEL (Common Expression Language) — an open-source Google standard — as the policy expression language, providing all four properties.

How it works

Corules's policy runtime sits in the enforcement path between your AI agent and the action it wants to take. The agent sends a structured context payload to /v1/validate. Corules evaluates the context against a compiled CEL policy set and returns a structured decision — ALLOW, BLOCK, or ESCALATE — with a reason and audit ID.

Every decision is recorded in an immutable audit ledger. You can replay any past decision by providing the policy_set_version and the normalized input hash — the result will be identical.

Policy example

Policies are written in CEL (Common Expression Language). They are compiled once at publish time and evaluated in microseconds at request time.

// Policy-as-code: version-controlled, compile-time validated, parameterized
// Logic stays constant; parameters change when business rules change

// Gate 1: what may the AI propose? (evaluated before AI reasoning)
POST /v1/constraints
→ { max_discount: 0.25, required_fields: ["customer_id", "deal_value"] }

// Gate 2: is this specific proposal valid? (evaluated before execution)
POST /v1/validate
Body: { discount_pct: 0.20, customer_tier: "premium" }
→ { outcome: "ALLOW", audit_id: "aud_01J..." }

Frequently Asked Questions