Agent policy
Also known as: agent action policy, agent guardrail policy, Cedar policy for agents, agent authorization policy
Guardrails inside a model prompt are advisory: you ask the model to stay within bounds, and it usually does. Agent policies are different. They are rules enforced by the infrastructure layer that runs the agent, intercepting every tool call before it executes and blocking any action that falls outside what the policy permits. Because enforcement happens outside the model, a compromised or misbehaving model cannot bypass the policy, even if it tries.
The pattern became a first-class concern in 2025 and 2026 as agents gained access to real-world tools: sending emails, making payments, deleting files, calling external APIs. The failure mode without policy enforcement is excessive agency: agents confidently taking actions that are technically within their tool access but outside the intent of the person who deployed them. Policies create hard limits on what an agent can actually do, independent of what the model believes it should do.
In practice, agent policies express things like: this agent may read any file but never write to production directories; this agent may call the payment API but only for amounts under $100; this agent must pause and request human approval before sending any external communication. AWS AgentCore uses Cedar (an open-source policy language) with natural-language compilation so teams can express rules in plain English that the system converts to machine-enforceable code. Microsoft Foundry has a similar policy intercept layer. As agents take on more consequential tasks, agent policy is becoming as standard a part of the deployment checklist as authentication and logging.