Policy as Code

The representation of access, security, or compliance policies as versioned, executable rules. In AI systems, it can control which data enters context, which tools an agent may call, which arguments are allowed, and when an action requires human approval.

Policy creates value when decisions are deterministic, testable, and recorded in the trace. Natural language remains useful for explaining intent but should not be the sole enforcement mechanism for a critical operation. Rules need an owner, tests, change review, and safe behavior when required data is missing.