Your company has a policy about what agents may touch. It is a good document: reviewed by legal, approved in March, sitting on the intranet where everyone ticked the box saying they had read it. Then an assistant summarises a deal file, puts a confidential figure into a message that leaves the building, and you go looking for the malfunction. There isn’t one. Nothing on the path from the prompt to the outbound call ever opened that document. No check quoted it. The policy existed the whole time, in the one place where it could not act.

The rule is built into the street

A council that wants cars to slow outside a school has two ways to get it. It can put up a sign asking for twenty, which works on the people who were going to slow down anyway. Or it can rebuild the street: narrow the carriageway, raise the surface at the crossing, break the straight run with a kink. Nobody reads the second one. It applies to every vehicle, at every hour, whether or not the person behind the wheel agrees with it, and it was designed once, drawn up as a scheme, and installed street after street from the same drawings.

Policy as code is that move. Guardrails, permissions and compliance requirements stop being prose and become configuration: versioned, tested, and shipped alongside the application they govern. A central package applies checks on the way in, before the action fires, and on the way out — on every agentic call, not on the ones somebody remembered. Handoffs, traces and decisions are recorded as they happen. A private-equity assistant runs each request through an input check, a triage step and an output check; the rule against confidential data leaving is enforced at all three, not hoped for. Because it ships as a package you install, the team next door gets the same rules you do, instead of each deploy inventing its own controls the week before launch. A rule in that shape gets reviewed in a diff before it ever runs.

A permit is written to one address

The same street does not carry the same rule for everyone on it. A lorry over a certain weight is turned back where a van is waved on. The bus lane is a bus lane by what the vehicle is, not by how urgent its errand is. The residents’ permit is written to one address, not to the road. And the national limit sits above all of it: a council can bring its own street down below that number and can never lift it above.

Agent platforms borrow both halves. A scope-owned workspace gives each person, channel or project its own files, memory, credentials, permissions and sandbox, so two teams working in the same chat tool are not sharing one indistinct space. A shared skill is granted to a pilot project first and promoted across the organisation only after somebody reviews what it can reach. The organisation’s security posture is the ceiling: a scope may tighten it and can never widen it. Sessions do the same job for identity. The harness opens a session bound to one user, holds that user’s authorised connections, and reuses it across turns, so the agent working for Alice finds her code host and her mail and nothing belonging to anybody else. The failures are dull: one keychain shared by every scope, a local setting that quietly relaxes the global one, a session reused by a second person with different rights.

A scheme nobody surveys is decoration

Little of this survives being rebuilt once per team, which is why platforms have started to carry it. Managed endpoints register which tools are trusted, apply one identity and permission layer across them, log what was called, and screen what comes back for instructions hiding in the content. A query against a warehouse goes out through that layer: permissions decide which datasets are in reach, the log keeps the query, the filter reads the response. Company APIs become tools without every server rebuilding auth and observability from scratch.

What keeps it honest is measurement. Ordinary runs and deliberate attempts to break the rules both feed evaluations of how often a check fires when it should and how often it fires when it shouldn’t, and a rule never tested against your own misuse is a leaflet with better formatting. The last two failures are timing and ownership: compliance bolted on the week before launch instead of living in the normal lifecycle of the code, and a central policy with no versioning and no owner, going stale where nobody can see it.

A policy you have to read is a policy you can forget. A policy that runs is simply how the system behaves.