Policy enforcement applies an authorization decision when an action executes, using the complete principal, action, resource, and context. For AI agents, every tool call must pass through this decision point; prompt instructions are not a security boundary. section 18.6.6 section 18.4.2
A policy-aware architecture uses enforcement to:
- Mediate every tool call rather than trusting the agent or its prompt. section 18.6.6
- Keep enforcement authoritative even when planning uses policy-derived constraints. section 18.4.2
- Limit delegated authority and analyze high-risk delegation paths before credentials are created. section 18.6.6
Planning versus execution
An agent may submit a partial request during planning and receive a policy residual that rules out unauthorized paths. When it later attempts a tool call, the policy engine evaluates the complete request and makes the final authorization decision. Planning guidance helps avoid denied actions; it does not grant permission. section 18.4.2
