Policy Enforcement

What it is

Making an organisation's own rules hold at runtime: the commitments about what the system may say, promise, recommend, or do, which come from legal, compliance, commercial, and brand owners rather than from any taxonomy of harm. The work is turning prose written for people into something evaluable on every request, keeping the two in step as the prose changes, and being able to show afterwards which version was in force when something was said.

Why this is not harm classification

A harm category describes content unacceptable anywhere: it is roughly the same for every operator, and it comes with shared taxonomies, public datasets, and off-the-shelf classifiers. A house rule is unacceptable only here. No recommendation of a specific security; no statement about a delivery date; a particular disclosure whenever one jurisdiction is detected; never name a competitor. Nothing about those strings is harmful, no public dataset exists for any of them, and the rule may be introduced on a Tuesday by someone who does not work in engineering. The machinery is therefore built around change — authoring, versioning, testing, effective dates, attribution — rather than around classifier quality, which is what a harm layer is built around. Deciding which rules the organisation needs and how they map to regulation is a governance activity; this is the part that executes on every request.

Why it matters

These rules are where the liability sits. A model that recommends an investment, confirms a refund nobody approved, or omits a required disclosure creates an obligation the organisation has to honour, and the only defence is a record of what the system was instructed to do together with evidence that it did it. Rules expressed solely as prose inside a system prompt provide neither: they cannot be tested, they cannot be shown to have been applied, and the authoritative statement of the organisation's commitments ends up being a string literal nobody in compliance has read.

Key decisions

• Where a rule is enforced: as an instruction, as a check on what was produced, or structurally by never giving the model the capability. Only the third survives a model that was persuaded.
• How a rule is represented: an executable predicate, a declarative policy, or natural language adjudicated by a model. The third expresses what the others cannot and cannot be shown to have been applied consistently.
• Scoping — tenant, jurisdiction, channel, segment, effective date. A single global rule set is a shape almost nobody actually has, and discovering that late means retrofitting scope everywhere.
• Precedence when two rules conflict, and whether the system can detect the conflict before a request encounters both.
• Who may change a rule, through what process, and how a change is tested before traffic sees it. This is a production change made by people outside engineering, on a timescale they control.
• What is recorded per request: the policy version, which rules were evaluated, and each outcome. Without that, a dispute about something said in March has nothing to examine.
• What a violation produces — block, rewrite, append the required text, or flag for review. Appending a disclosure is enforcement; rewriting the substance is authorship, with the accountability that implies.

Failure modes

• The rule is updated in the policy document and nowhere else, so the authoritative description of system behaviour is a prompt no compliance owner has ever seen.
• A required disclosure is appended beneath an answer that has already contradicted it in the body.
• Rules are evaluated against the response text while the obligation concerned an action, which was performed four steps earlier and is not mentioned in the answer.
• Rules accumulate without review until they conflict, and which one wins depends on an evaluation order nobody documented or intended.
• A jurisdiction-specific rule keys on a profile field that is empty for most accounts, so the rule quietly applies to almost nobody and the coverage metric still reads as enabled.
• No policy version is recorded per request, so a complaint about a conversation from eight months ago cannot be answered at all.
• Enforcement covers the main conversational path and not the summarisation, notification, digest, and export paths that also produce text for the same person.
• A natural-language rule is adjudicated by a model whose judgement on identical input varies between runs, and the variance is invisible because only violations are logged.
• A rule is written to catch a phrasing rather than a commitment, and the model makes the same promise in different words on the next release.

Related capabilities

• Content Moderation — harm categories, which are shared across operators in a way these rules are not
• Tool Guardrails — where a rule about an action rather than a statement is enforced
• Output Guardrails — the checkpoint a statement-level rule is evaluated at
• Human Approval Gates — the escalation path for a case no rule resolves cleanly
• Fail-closed Behavior — what the system does when the policy bundle cannot be loaded

Applies: Production readiness · Design questions