How to connect an AI agent to your policy library

Connect it read-only, and only to approved, versioned documents. The agent should be able to search policies, read a named version, see which version is in force and who owns it, and write proposed changes into a separate drafting space. It should never be able to approve, publish or retire a policy. Every read and every proposal is logged.

What is a policy library, and who owns the connection?

A policy library is the controlled store of the firm's policies, standards and procedures: each document with an owner, a version, an approval record, an effective date and a review date. For an agent it is the most important source it will read, because the library tells it what the firm requires. An agent answering a staff question, checking a procedure or drafting a customer letter is only as reliable as the version of policy it reads.

The library is usually owned by compliance or a policy governance team; document owners own their content. The connection should be approved by both, because once agents read the library, its contents become live instructions rather than reference material. That is why policy libraries must be versioned before agents use them.

Which permissions should you grant, and at what depth?

1. Person, library owner: gives the agent its own read identity. Not a person's account, and not the library's admin interface.
2. Person, library owner: limits it to approved documents. Drafts, documents under review and retired versions are not visible by default. Where an agent needs history, for example to check what policy applied on a past date, grant read access to retired versions as a separate capability.
3. Agent, depth 1: searches and reads. Every response that relies on policy cites the document, version and section.
4. Agent, depth 2: proposes changes into a drafting space. A tracked-change draft against a named version, with its reason, assigned to the document owner. It cannot write to the approved document.
5. Person, document owner: decides. Accepts, edits or rejects the proposal, and takes it through the normal approval route.
6. Person, approver: approves and publishes. Publishing is outside the agent's role.
7. Agent, depth 1: notices new versions. When a document changes, it flags dependent items it has used, such as answers, templates or procedures, for review.

Which controls apply, and what is recorded?

Approved means approved. The connection filters on approval status at source, not in the agent's instructions. An instruction to "only use approved policies" can be ignored or confused; a library that only returns approved documents cannot. Evidence: the connector configuration.

Citation required. An answer that relies on policy without citing a version is treated as incomplete. Evidence: each answer in the agent's record carries document, version and section.

Proposals separate from the record. The drafting space is distinct from the approved library, with its own history. Evidence: every proposal shows its author as the agent, its base version, and the owner's decision.

Read log. Which documents the agent read, for which task. Evidence: useful when a staff member says "the agent told me X" and you need to see what it read.

Revocation. One switch removes the agent's access, tested before go-live.

What does the agent do with what it reads?

The common uses are answering staff policy questions, checking procedures against policy and drafting updates after a regulatory change. In customer-facing work, policy also tells the agent what to refuse and how to explain it; a refusal reasons library lets those explanations point back to policy without quoting internal text. The rules that govern the agents themselves belong in the library too, written using an AI agent policy template.

Note the difference from an insurer's policy administration system, which holds customer insurance policies, not internal rules. That connection has different risks and is covered in connecting an agent to a policy administration system.

What should you measure?

• Answers without a citation, which should be zero.
• Answers citing a superseded version, found by sampling.
• Proposals accepted, edited or rejected by document owners.
• Time from a new version to dependent items being updated.
• Documents past their review date that the agent is still citing; the library should warn on these.

Where does it usually go wrong?

Two libraries. The official library and a shared drive both hold policies, and the agent can see both. It will eventually cite the wrong one. Connect only the controlled library.

Policies the agent cannot parse. Long scanned documents, policies inside slide decks, tables as images. The agent reads them badly and cites them confidently. Fix the format before connecting.

Local variations missing. A group policy with country addenda: if the agent reads only the group policy, it gives answers that are wrong in some markets. Make the applicable addendum part of the same versioned document set.

Drafts leaking. A draft under consultation is visible, and the agent quotes it as policy. Filter at source.

The role of compliance agents overall is set out in AI compliance agents.