Your security policy is a PDF. Your AI agent can't read PDFs.

Many organizations create a security or data-handling policy, writing, reviewing, and approving it before storing it away. Employees are then given access to production tools, yet they have no knowledge of this policy. They are unaware of guidelines such as not exporting customer records to personal drives, or the need for double approval for refunds exceeding a certain amount.

The gap between policy and actual enforcement is significant. There is an attempt at a solution where the policy is pasted into the system prompt, but this still leaves the model with just words to respect, susceptible to prompt injection attacks. More effective would be turning the policy into checks that the agent must pass, rather than merely remembering text.

Instead of simply stating "refunds over $500 require a manager," it would become a function that the agent must call before executing a refund. Customer data being confined to the EU region would be a validation on the tool's arguments. AgentPolicy is a tool that converts company policy text into agent-callable policy checks and a compliance checklist, aligning them with EU AI Act obligations.

This generates exportable rules that can be wired into the agent's tool layer for enforcement, rather than relying on context alone. It's important to note that AgentPolicy is not legal advice; the generated checks are a starting point for review, not a finalized control set. The policy-to-rules conversion can only be as effective as the policy text provided.

A test to determine the effectiveness of such a system would involve selecting a policy sentence that the team clearly follows and asking if an AI agent, with the necessary credentials, could technically violate it. If the answer is that someone would notice in the audit logs, then it is a detection, not a prevention, and the gap between policy and enforcement should be closed before an agent can exploit it.