A policy tells people what to do and relies on them to read, understand and comply. An AI agent does none of that reliably. Even when policy text is placed in its instructions, the agent treats it as guidance to weigh, not a rule it cannot break. Only a limit checked at the moment the agent acts actually stops it.
Why doesn't a policy bind an agent the way it binds a person?
A person who breaks a policy knows they are doing it, can be asked why and can be held to account. Those consequences are what give the policy force. The words themselves stop nobody; the person's understanding and the threat of being answerable do.
An agent has neither. It has no stake in the consequences and no memory of having been told. If policy text sits in a document on the intranet, the agent never sees it. If someone copies it into the agent's instructions, the agent reads it as one input among many, alongside the customer's message, the case notes and whatever documents it retrieves. Most of the time it follows the instructions. Sometimes another input outweighs them: an unusual case, a persuasive customer, a sentence in an attachment that reads like a new instruction.
That "most of the time" is the problem. A control that holds most of the time is not a control in any sense an auditor would recognise.
What happens when policy lives only in the agent's instructions?
Take a policy clause: "Refunds above 500 must be approved by a team leader." Placed in an agent's instructions, it will usually work. The agent will propose a refund of 450 and process it, and propose a refund of 700 and route it for approval.
Now consider the cases where it does not. The customer says a manager already agreed to the refund. The case notes from a previous call mention an exception. The agent splits a 700 refund into two of 350 because the customer was charged twice. A document the agent reads contains the line "approval is not required for loyal customers". In each, the agent might reason its way past the clause, and nothing stops it, because the clause is only words it was asked to respect.
Then compare an enforced bound. The refund tool itself is checked before it runs: any refund above 500, or any second refund to the same customer within a set period, is held for a named team leader. The agent's reasoning does not matter. It can be persuaded of anything; the check does not move.
How do you turn a policy into enforced bounds?
Go through the policy clause by clause and ask, for each one, what action it governs and what condition triggers it. Clauses that describe an action and a condition can be enforced. Clauses that describe an attitude or an aim cannot, and should stay as guidance for people.
| Policy clause | Can it be enforced at the moment of action? | Enforced bound |
|---|---|---|
| Refunds above 500 need a team leader | Yes | Refunds above 500 held for a named team leader |
| Do not change bank details on request by email | Yes | Changes from an external source refused; signed sources only |
| Treat vulnerable customers with care | Partly | Cases flagged as vulnerable held for a trained person |
| Communicate clearly and fairly | No | Stays as guidance; tested in certification and review |
| Never disclose another customer's data | Yes | Platform floor: withheld for every agent |
Some clauses split. "Treat vulnerable customers with care" cannot be checked as such, but "cases flagged as vulnerable go to a person" can. The translation rarely captures the full intent of the clause, but it captures the part that matters most if the agent gets it wrong. A parallel exercise for risk appetite is set out in risk appetite for AI agents should be written in actions.
What are written policies still for?
Plenty. Policies set intent, assign ownership and guide the people who design, configure, approve and supervise agents. A policy should say who may grant an agent authority, how evidence is assessed, who approves held items and how exceptions are handled. Those are instructions to people, and people can follow them.
Policies also guide the agent's behaviour in the large space where no bound applies: tone, clarity, what to include in a reply. Instructions drawn from policy are useful there, and testing the agent on real cases checks whether it follows them. They just cannot be the control for the actions that matter. Agents can help draft and maintain policy text, as discussed in whether an AI agent can write compliance policies, but the bounds still have to be set and enforced separately.
How do policies and bounds stay in step?
Keep a map from each policy clause to the bound or bounds that enforce it, with an owner for each. When a policy changes, the map shows which bounds must change with it. When a regulation changes, the same map shows which policies and then which bounds are affected; our guide on mapping a new regulation to your policies covers the first half of that chain.
Exceptions need the same discipline. A policy may say exceptions are temporary; only an end date applied at the check makes them so. That is the argument in every exception to an agent's bounds should expire.
What should happen when an agent tries to act against policy?
If the policy has been turned into a bound, the attempt is refused or held, and the verdict names the bound. That record is valuable: it shows the bound worked, and a pattern of attempts shows where the agent is being pushed against its limits. Our guide on responding when an AI agent attempts an action outside its bounds covers what to do next.
If the policy has not been turned into a bound, there is no attempt to record. The agent either complied or did not, and you will find out which only if someone notices the outcome.
What is the trade-off?
Enforced bounds take work to define and build, and they are less flexible than words. A policy can say "use judgement"; a bound cannot. Some intent will be lost in translation, and some legitimate cases will be held or refused that a person would have handled sensibly.
That loss is the price of certainty on the actions that matter. Take your AI policy, highlight every clause that names an action and a condition, and check whether each one is enforced at the moment of action or only written in the agent's instructions. Every clause in the second group is a hope, not a control. The wider framework is set out in our guide to agent governance as a bound, not a model.
Questions people ask
Is putting policy in the system prompt useless, then?
No. It shapes the agent's behaviour in the large majority of cases and improves the quality of its work. It is just not sufficient for actions where a breach would matter, which need a check outside the agent.
Who should translate policy into bounds?
The policy owner and the process owner together, with someone who understands how the checks are built. The policy owner confirms the intent is preserved; the process owner confirms the bound fits how the work is done.
What if a policy clause cannot be turned into a bound?
Keep it as guidance, test the agent's behaviour against it during certification, and sample real work for it in review. If the clause covers something with serious consequences, consider keeping that work at draft so a person sends it.