Deep Dive
Policy as Code for AI Agents
A policy that lives in someone's head, a wiki page, or a Slack message from eight months ago isn't a policy. It's a hope. Argus treats every access decision as code: written down, versioned, testable, and evaluated the same way every single time, for every agent, on every request.
The decision
The question policy actually answers
Strip away the implementation and every access decision reduces to three questions, asked together:
Who
is making this request.
What
are they asking to access.
When
is this happening, and does that context matter.
A written policy rule looks like this: a given role can perform a given action on a given resource. Argus evaluates every request against rules exactly like this one, the same way, every time. There's no hidden judgment call, no model guessing what seems reasonable in the moment, just a rule, checked.
Why deterministic
Why deterministic, not probabilistic
Strip away the syntax and a policy is just three things tied together: who's asking, what they're trying to do, and what they're trying to do it to. Argus checks a request against these written rules directly, no interpretation involved. That's what makes the outcome explainable after the fact. If an auditor asks why a request was permitted six months ago, the answer is the rule itself, not a best guess about what a model was thinking.
Shape of a policy
What a policy actually looks like
Without exposing implementation, the shape of a policy reads close to plain English: an agent with a given role can perform a given action on a given resource, under conditions that can include time, location, or the resource's own sensitivity classification. Policies are versioned like code, reviewed like code, and tested like code, because they carry the same consequences as code when they're wrong.
What's on the roadmap
Rules like this one cover a lot of ground, but not every access decision is a clean fit for a static rule. We're exploring how a policy-aware agent could eventually sit alongside the rule engine to help with judgment calls current rules can't express well. That's a direction under active exploration, not something built today. The rule engine you're reading about on this page is what evaluates every request right now.
See policy evaluation in action
Get a guided walkthrough of the Argus control plane on your own agents.