Glossary
Policy as code
Writing an agent's rules as versioned code in your own repository, reviewed in pull requests and tested before they enforce, instead of as settings in a dashboard.
Policy as code means the rules an AI agent must follow, such as "never promise a refund outside 30 days" or "hold any refund over $2,000 for approval", live as code in your own repository rather than as toggles in a vendor dashboard.
That gives agent policy the same properties as the rest of your software:
- Versioned. Every change to a rule has a commit, an author and a diff.
- Reviewed. Rules change through pull requests, so a second person sees a new rule before customers do.
- Tested. A rule is backtested against past traffic before it can block.
- Attributable. When someone asks why the agent did something, you can point at the exact rule and the version that was live.
How it runs
In Zespan, policies compile into a bundle that the SDK evaluates inside your own service (in-process enforcement), so a rule adds no network call. A recurring issue Zespan has already detected can be promoted into a policy, which is how a failure you've seen once becomes one that can't ship again. Policy-as-Code is part of the Pro plan and above; see pricing.