Policy Engine
Learn how to create and manage runtime policies that keep your AI agents safe and compliant.
What are Policies?
Policies are rules that govern how your AI agents can behave at runtime.
The RunLog AI policy engine evaluates every action your agents want to take against a set of configurable rules. Policies can prevent unsafe actions, require human approval, or modify behavior based on context.
Policies are evaluated in real-time with sub-10ms latency, ensuring your agents remain responsive while staying safe.
Policy Types
Budget Controls
Prevent cost overruns with spending limits
max_cost_per_run: $1.00PII Protection
Block processing of sensitive personal data
block_pii: trueApproval Workflows
Require human approval for high-risk actions
require_approval: financial_actionsPolicy Configuration
Policies are defined using YAML configuration files
# Example policy configuration
policies:
- id: budget_control
name: "Daily Budget Limit"
when:
cost_today: { gt: 100.00 }
action: deny
message: "Daily budget exceeded"
- id: pii_protection
name: "PII Detection"
when:
tool: "database.query"
args.query: { contains_pii: true }
action: require_approval
approvers: ["security-team"]
- id: loop_detection
name: "Infinite Loop Prevention"
when:
tool_calls_in_run: { gt: 50 }
action: terminate
message: "Possible infinite loop detected"Policy Actions
What happens when a policy is triggered
denyBlock Action
Immediately prevent the action from executing and return an error to the agent.
require_approvalHuman Approval
Pause execution and wait for human approval before proceeding.
modifyModify Parameters
Change the parameters of the action before allowing it to proceed.
logLog & Allow
Log the policy violation but allow the action to proceed normally.
Best Practices
Tips for effective policy management
- Start with permissive policies and gradually tighten based on observed behavior
- Use descriptive policy names and messages to help with debugging
- Test policy changes using deterministic replay before deploying to production
- Monitor policy violation rates and adjust thresholds as needed
- Use approval workflows for high-risk actions rather than blanket denials
- Regularly review and update policies as your agents evolve