A policy that lives in a document is a hope. A policy that lives in the request path is a control. Botmanor's policy objects — written once per workspace, versioned, reviewable, shippable as store packages — are read by the runtime on every agent turn and enforced before the model produces anything a compliance officer would have to explain.
The order is deliberate and cheap-first. A rate-limit policy is evaluated before anything else, so a runaway integration is stopped before it consumes inference. A budget policy is checked next against the workspace's token consumption for the day. Then the user's message itself is evaluated against the content policy: blocked keywords, blocked patterns you supply as regular expressions, and an opt-in set of conservative PII heuristics — social-security-shaped numbers, credit-card-shaped digit runs, email addresses. Only then is the model called.
The response gets the same treatment. Content evaluation runs again on the model's output, and a violation does not leak a partial answer or a raw error: the turn returns a single, explicit refusal — "I can't share that response, it was blocked by this workspace's content policy" — and the identical copy is used on the channel path, so a Slack user and an in-app user see the same message rather than two different failure modes.
The design choice worth stating plainly is what happens when there is no policy. Enforcement is fail-open by construction: a workspace that has configured no content policy behaves exactly as it did before enforcement existed. This is not laxity, it is scope discipline — a *configured* policy is genuinely binding, and an unconfigured one does not silently start blocking traffic for tenants who never asked. Tool policies extend the same model to agent-to-agent traffic, gating connections and messages on a minimum trust level.
Two honest boundaries. Policy enforcement covers rate limits, budgets, content and agent-to-agent trust; prompt-injection resistance — a system prompt that ignores instructions embedded in retrieved documents, hostile tool output or a poisoned store package — and mandatory confirmation for destructive agent actions are the next tranche of work on this path, not shipped behaviour. And the platform's own AI-credit ceiling, separate from your customer-authored budget policy, is still to come. Botmanor distinguishes the two rather than letting one imply the other.
Today the policy evaluator runs in the execution layer, but authoring an ACTIVE policy with the config shape the evaluator recognises requires the API — the UI creates DRAFT policies with a mismatched config shape. Because a real user cannot complete the full story by clicking through the web app alone, this page is presented as a narrative pattern rather than a clickable "Do it yourself" section.
Ready to make this your story?
