Policy-as-code for AI agents

The problem with prompt-level safety

Policy-as-code is one layer in the broader picture of governance for AI agents. It sits at the action boundary — the place where the model's intent becomes a real-world side effect. The default pattern for "safe" AI agents looks like this: a long system prompt that describes what the agent is and isn't allowed to do, plus a hope that the model will follow it. That works until the input shifts, the model is updated, or an adversary writes "ignore previous instructions". The constraint lives in natural language, inside a probabilistic system, and there is no audit trail of why a specific decision was made.

For consumer chat that's an acceptable trade. For an agent that touches a production database, sends money, deploys infrastructure, or takes actions on a user's behalf, it isn't.

What policy-as-code means for AI agents

Policy-as-code is the same idea that runs your Kubernetes admission control, your microservice authorisation, and your cloud IAM: the rules that decide allow / deny / require-approval are written as code, version-controlled in git, code-reviewed, tested, and evaluated by a deterministic engine at runtime.

Applied to AI agents, the policy doesn't try to constrain the model's reasoning. It governs the actions the agent attempts to take. Every tool call, every sub-agent spawn, every delegation, every resource request becomes a structured event. The policy engine looks at the event plus the session context and returns a decision.

Why OPA/Rego specifically

OPA (Open Policy Agent) is a CNCF graduated project. Rego is its policy language. Together they're the de facto standard for policy-as-code across cloud-native infrastructure, with mature tooling for testing, decision logging, bundle distribution, and multi-tenant evaluation.

Choosing OPA for AI agent governance means:

• One policy language across the stack. Your platform team already writes Rego. Agent policy lives in the same repo, the same review process, the same CI.
• Deterministic decisions. Same input + same policy = same decision. Reproducible in tests, defensible in audits.
• Decision logs out of the box. Every evaluation can be recorded with the policy version and the input. That's the audit trail regulators ask for.
• No new DSL to learn. Engineers don't need to pick up a framework-specific dialect that only governs one library.

What you actually govern

Concretely, an AI agent governance policy answers questions like:

• Can this agent invoke shell.exec at all? With what arguments?
• Is this file write inside an allowed directory?
• This agent wants to spawn a sub-agent — what scope is the child allowed? Is it a subset of the parent?
• Has this session already exhausted its token / API-call / wall-clock budget?
• This proposed plan contains 24 steps and three calls to a write tool. Is it allowed to run, or does it need human approval first?
• This data is classified as confidential — is the agent allowed to send it to an external tool tier?
• The same engine governs an MCP tool call identically to a native Python tool call.

None of those are "is this prompt unsafe?" questions. They're authorisation questions, and they have hard, code-shaped answers.

How this differs from output validation and prompt scanning

Tools like Guardrails AI validate the model's output. Tools like LLM Guard scan prompts and responses for content patterns. Tools like NeMo Guardrails script dialogue rails. None of those layers answer "is this agent allowed to invoke this tool right now?" — that's the question policy-as-code is built for.

Where Kite Logik fits

Kite Logik is the policy enforcement point for AI agents in Python. It plugs into your existing agent framework (OpenAI Agents SDK, LangChain, LangGraph, CrewAI, Pydantic AI, and others), turns runtime events into structured policy inputs, evaluates them against your Rego policies, and emits an immutable audit log of every decision.

The model still drives the agent. Policy decides whether the agent gets to act on what the model proposed.

Frequently asked questions