From policy PDF to runtime: enforcing AI governance on every agent call

There's a gap between having an AI usage policy and enforcing it. The document says "the support agent doesn't access financial data". But who guarantees that on call #4,385, at 2 a.m., when nobody is watching?

Governance that lives in a PDF is intent. Governance that lives in the runtime is operations.

What a contextual policy (CSP) is

A Contextual Security Policy ties a permission decision to the context of the execution, not just to the identity of the caller. Five axes cover most real-world needs:

• Origin — which channel or application the request came from.
• Schedule — time windows in which certain actions are allowed.
• Data — which fields the agent can read or write.
• Behavior — limits on volume, frequency and escalation.
• Custom — rules specific to your domain.

Note: The policy isn't a front-end filter or a reminder in the prompt. It's a check executed in the runtime, before the tool runs — the agent simply can't cross the line.

Scope inheritance: tenant → agent → user

What makes this workable at scale is inheritance. You define the most restrictive policy at the top (tenant), and each level below can tighten — never loosen — what it inherited:

tenant → the organization's compliance baseline agent → what this agent can do user → what this user can trigger on the agent 

So a data-protection rule (LGPD, Brazil's privacy law) defined once on the tenant applies to every agent and user, with no need to paste it into each configuration. Less surface for human error — and human error is what causes most over-access.

Without evidence, there was no governance

Enforcing the rule is half the job. The other half is proving it was enforced. Every policy decision is recorded and can be reconstructed in the session replay: who asked, what the policy decided, and why.

Tip: An audit shouldn't be a weeks-long project. With full replay, answering "has the agent ever accessed this data?" is a query, not an excavation.

Governing is the second pillar — the inseparable partner of Reach. It's no use for the agent to reach everything if it doesn't respect limits wherever it lands. Put the two together and AI stops being a compliance risk and becomes an auditable asset. Talk to us.

Originally published in Portuguese on the Zihin blog. I work at Zihin, which connects AI agents to a company's systems and processes, with permissions, human approvals and cost tracking.