Inline Agent Policy Template: Block Before Damage

When your agent fleet makes thousands of autonomous decisions per hour, after-the-fact alerts turn into incident reports. You need a policy that runs inline and blocks at execution time, not logs that explain what went wrong after a record leaked.

This template provides a starting point for enforceable agent policy at the control plane layer. It's designed for teams managing multi-agent systems where one agent's output becomes another's input, and traditional API gateways handle routing but can't inspect semantic threats in tool responses.

Purpose of This Template

This policy definition template for an AI agent control plane governs agent behavior across tool calls, model interactions, and multi-agent handoffs. Unlike gateway access controls that answer "can this agent call this endpoint?", this template addresses content-level questions: what came back from that endpoint, does it contain PII, and should the agent be allowed to act on it?

The template handles three threat vectors that proxies miss:

Inbound data governance: Tool responses and MCP server outputs that carry sensitive data or prompt injection payloads directly into agent context. MCP, the open standard connecting agents to external tools, has made this inbound path both common and standardized.

Multi-agent propagation: Malicious payloads that travel from one agent's tool response to another agent's instruction set, even when every individual call passes gateway authorization.

Semantic threats in content: Hallucinations in financial calculations, unauthorized credential exfiltration in generated output, and behavioral misalignment where agents reason around constraints rather than comply with them.

Prerequisites

Before you implement this template, ensure you have:

• An AI control plane capable of inline policy enforcement (not just logging)
• Standardized telemetry capturing full execution context across tool and model calls
• Evaluation infrastructure that runs in your environment without external API calls
• An AI registry showing live, testing, and retired agents across your organization

If you're running agents through a gateway alone, that gateway can route traffic and enforce access controls, but it cannot execute the semantic verdicts this template requires.

The Template

# Agent Policy Definition v1.0
# Applies to: All production agents, third-party agents, coding agents

policy_metadata:
  policy_id: "AGT-POL-001"
  version: "1.0"
  scope: "production_agents"
  framework_alignment:
    - "ISO/IEC 42001 [Annex A Controls](/glossary/annex-a-controls)"
    - "NIST AI RMF Govern function"
    - "SR 11-7 ongoing monitoring requirements"
  last_reviewed: "YYYY-MM-DD"
  review_frequency: "quarterly"

# INBOUND DATA CONTROLS
# Governs tool responses and MCP server outputs before they enter agent context

inbound_rules:
  - rule_id: "IN-001"
    name: "PII Detection and Redaction"
    trigger: "tool_response_received"
    condition: "contains_pii"
    verdict: "redact"
    redaction_method: "mask_with_placeholder"
    log_level: "warn"
    
  - rule_id: "IN-002"
    name: "PHI Blocking"
    trigger: "tool_response_received"
    condition: "contains_phi"
    verdict: "block"
    log_level: "alert"
    escalation: "security_team"
    
  - rule_id: "IN-003"
    name: "Prompt Injection Detection"
    trigger: "tool_response_received"
    condition: "injection_pattern_detected"
    verdict: "block"
    log_level: "alert"
    response: "return_error_to_agent"

# OUTBOUND ACTION CONTROLS
# Governs agent actions before execution

outbound_rules:
  - rule_id: "OUT-001"
    name: "Credential Exfiltration Prevention"
    trigger: "before_model_call"
    condition: "contains_api_key OR contains_password OR contains_token"
    verdict: "block"
    log_level: "critical"
    
  - rule_id: "OUT-002"
    name: "Financial Calculation Validation"
    trigger: "before_tool_execution"
    condition: "tool_category == 'financial' AND confidence_score < 0.95"
    verdict: "require_human_review"
    log_level: "warn"
    
  - rule_id: "OUT-003"
    name: "External API [Rate Limiting](/glossary/rate-limiting)"
    trigger: "before_tool_execution"
    condition: "tool_type == 'external_api' AND rate_limit_exceeded"
    verdict: "defer"
    retry_after: "60s"

# MULTI-AGENT HANDOFF CONTROLS
# Governs data passed between agents

handoff_rules:
  - rule_id: "HO-001"
    name: "Context Sanitization"
    trigger: "before_agent_handoff"
    condition: "always"
    action: "scan_for_injected_instructions"
    verdict_if_detected: "block"
    
  - rule_id: "HO-002"
    name: "Permission Inheritance Check"
    trigger: "before_agent_handoff"
    condition: "target_agent_permissions < source_agent_permissions"
    verdict: "strip_restricted_context"

# CODING AGENT CONTROLS
# Governs IDE/CLI agents with file system access

coding_agent_rules:
  - rule_id: "CA-001"
    name: "Source Code Exfiltration Prevention"
    trigger: "before_mcp_server_call"
    condition: "file_path matches proprietary_code_patterns"
    verdict: "block"
    
  - rule_id: "CA-002"
    name: "Unauthorized File System Access"
    trigger: "before_file_operation"
    condition: "path outside allowed_directories"
    verdict: "block"
    log_level: "alert"

# EVALUATION REQUIREMENTS
# Defines when and how agent decisions are evaluated

evaluation_config:
  mode: "continuous"  # not sampled
  coverage: "100%"    # every decision, not 10%
  evaluator: "in_environment"  # no external LLM calls
  max_latency: "100ms"
  
  evaluation_criteria:
    - criterion: "factual_consistency"
      threshold: 0.90
      verdict_if_below: "flag_for_review"
      
    - criterion: "policy_compliance"
      threshold: 1.0
      verdict_if_below: "block"
      
    - criterion: "output_safety"
      threshold: 0.95
      verdict_if_below: "require_human_review"

# AUDIT AND GOVERNANCE
# Defines what gets logged and how incidents escalate

audit_config:
  log_retention: "24_months"  # SOC 2 requirement
  log_format: "structured_json"
  include_full_context: true
  include_decision_lineage: true
  
  incident_escalation:
    - severity: "critical"
      notify: ["security_team", "compliance_team"]
      sla: "15_minutes"
      
    - severity: "alert"
      notify: ["model_risk_team"]
      sla: "4_hours"

How to Customize It

Map your threat model first: Identify where sensitive data enters (tool responses, MCP servers, file reads) and where it could exit (model calls, API invocations, agent handoffs). Your inbound and outbound rules should cover every identified path.

Set verdicts based on consequence: Use block for actions that violate regulatory requirements or create immediate risk. Use redact when the data itself is the problem but the action is valid. Use require_human_review when you need a human in the loop but can't define a bright-line rule.

Adjust evaluation thresholds to your risk tolerance: A financial services firm running agents that calculate loan terms will set factual_consistency and policy_compliance thresholds higher than a team running agents that draft internal documentation. Start conservative and relax only after you have production telemetry showing false positive rates.

Align framework references to your requirements: The template cites ISO/IEC 42001 Annex A Controls, NIST AI RMF, and SR 11-7. If you're subject to GDPR, add Data Protection Impact Assessment alignment. If you're deploying high-risk AI under the EU AI Act, add Technical Documentation (Annex IV) references.

Configure evaluation to avoid sampling blind spots: The template sets coverage: "100%" because hallucinations and prompt injections occur at low frequencies. A 10% sample can miss them entirely. If evaluation cost is a constraint, use an in-environment evaluator rather than down-sampling coverage.

Validation Steps

1. Test each rule in isolation: Deploy the policy in a staging environment and trigger each condition deliberately. Verify that block verdicts prevent execution, redact verdicts mask the expected data, and require_human_review verdicts route to your review queue.

2. Validate multi-agent propagation controls: Set up a test where Agent A calls a tool that returns a malicious payload, then hands off to Agent B. Rule HO-001 should detect and block the injected instructions before Agent B receives them.

3. Confirm evaluation runs inline: Check that evaluation completes before the agent acts, not after. Log timestamps should show evaluation latency under your max_latency threshold (100ms in the template).

4. Audit the audit trail: Pull a sample of logged decisions and verify you can reconstruct what the agent did, what data it saw, and why it made each decision. If you can only see which endpoints were called, you have connectivity records, not behavioral oversight.

5. Measure false positive rate: Track how often block and require_human_review verdicts fire on legitimate agent actions. If you're blocking more than 2% of valid requests, your thresholds are too strict or your conditions are too broad.

6. Run a Red Teaming: Have your security team attempt to exfiltrate credentials through generated code, inject instructions through tool responses, and bypass rate limits through agent handoffs. Every successful attack should map to a policy gap you can close with a new rule.

This template isn't a compliance checklist. It's a starting configuration that assumes you already have a control plane capable of inline enforcement. If you're still routing agents through a gateway alone, you can't execute these verdicts, and the template becomes documentation of what you wish you could enforce rather than what you actually do.