Policy Is Code, Not a Prompt

A tool call is evaluated by a policy gateway that returns ALLOW to the executor or FORBID back to the agent — so a delete never reaches the datastore

Policy Is Code, Not a Prompt A tool call is evaluated by a policy gateway that returns ALLOW to the executor or FORBID back to the agent — so a delete never reaches the datastore 01 / Agent Runtime 02 / Policy Boundary 03 / Tool Execution EX / Denied Agent · proposes delete(record) · Agent Runtime Agent proposes delete(record) Policy Gateway · evaluate vs policy · Policy Boundary · code, not prompt Policy Gateway evaluate vs policy code, not prompt Tool Executor · runs approved call · Tool Execution Tool Executor runs approved call Datastore · durable state · Tool Execution Datastore durable state Forbidden · delete blocked · Denied Forbidden delete blocked tool call ALLOW FORBID Legend User UI Agent logic Policy Tool action Context / trace

Enforcement

  • • The gateway is real code on the call path
  • • ALLOW forwards the call to the executor
  • • Policy is versioned and testable

Why Not a Prompt

  • • A prompt can be talked around
  • • FORBID stops a delete before the datastore
  • • Denials return to the agent, not the data

Workflow diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • T theme • E export