Policy-as-Prompt: Turning AI Governance Rules into Guardrails for AI Agents

Policies can be automatically converted into real-time safety controls: The paper demonstrates that organizations can transform existing policy documents (like product requirements and design specifications) into executable guardrails that monitor AI agent behavior in real-time, rather than relying solely on post-deployment audits.

The system reduces multiple concrete safety risks: Evaluations show the approach successfully mitigates prompt-injection attacks, prevents AI agents from handling requests outside their intended scope, and filters toxic outputs—addressing three distinct categories of AI safety concerns.

Compliance becomes traceable and auditable: By maintaining complete provenance and audit logs linked back to original policy documents, the system creates a documented chain of evidence showing why specific decisions were made, which is critical for regulatory compliance and organizational accountability.

Human oversight remains central to the process: Rather than fully automating compliance, the framework integrates human-in-the-loop review, ensuring that final decisions about policy enforcement involve human judgment and can be contested or refined based on real-world outcomes.

This approach enables "secure-by-design" deployment: By embedding governance rules directly into how AI agents operate (rather than bolting on safety measures afterward), organizations can build compliance into their systems from the start, potentially reducing both safety risks and the cost of compliance efforts.