Policies
A policy in BRAIAN is a rule the control plane enforces at runtime, before a tool call executes. Policies cover approval thresholds, data residency, model restrictions, field-level access and time windows. They are versioned, testable and independent of prompts, so no model output can relax them.
How does enforcement work?
Every tool call passes through the control plane. The plane resolves the policies that apply to the agent, the environment and the data classification of the payload, then allows, denies or escalates the call. The decision and its reason are written to the audit log.
name: finance.payment-threshold
applies_to:
tools: [sap.invoices.post]
rules:
- when: amount <= 10000
then: allow
- when: amount <= 100000
then: escalate
to: role:finance-controller
- default: denyPolicy categories
- Approval
- Amount, risk or counterparty thresholds that require a named human role.
- Data residency
- Restricts processing and storage to declared regions, for example CH and EU only.
- Model restriction
- Limits which models may see which data classifications.
- Field access
- Masks or blocks specific fields, such as salary or identification numbers.
- Time window
- Allows execution only during defined operational hours.
Testing before activation
Policies are evaluated against recorded runs before they are activated, so their effect is known in advance.
braian policy test finance.payment-threshold --against last-30d
braian policy activate finance.payment-threshold --env production