Policy-as-Code Governance for Agentic Enterprise Workflows

Access control determines whether an agent agent governance. The present question is narrower: how may use a tool; it does not necessarily establish that a should an enterprise represent a reviewer's consent, prevent its reviewer approved the exact action the tool will perform. reuse for a changed action, and connect that consent to release Enterprise workflows therefore need approval that authority, commit, and user-visible failure? AgentDojo remains bound to requester, target, arguments, relevant supplies an adversarial evaluation setting [10], but an agent state, and approved software versions until execution. This benchmark alone cannot establish coverage of every enterprise article specifies an approval-to-execution contract with mutation path. explicit consent states, non-transferable action matching, single-use redemption, and failure feedback. Its A Specific contribution and limits of novelty contribution is the contract and its operational invariants The artifact is an approval-to-execution contract with five at the enterprise mutation boundary, not a new policy explicit commitments: consent names a canonical action; language or the invention of transaction authorization. changes invalidate matching; redemption rechecks current Comparisons distinguish the contract from learned access access, state, and release; one successful commit consumes the policies, event-graph monitoring, and Open Policy Agent approval; and every unsuccessful attempt returns a stable logging and bundles. A Python and SQLite demonstration reason and remedy without weakening authorization. This matched 15 authored scenarios. Eight concurrent attempts contract is the unit evaluated, rather than a collection of agent to redeem one approval produced one simulated write and prompts. Its testable outputs are a redemption decision, a one receipt. Local workload measurements and a concise consumption transition, a mutation receipt, and a failure evaluation protocol establish reproducibility while response. separating demonstrated adapter behavior from untested Transaction-specific authorization is established practice: enterprise security and LLM performance. OAuth rich authorization requests already carry fine-grained Keywords - Policy as code; enterprise AI; transaction-bound action details [11]. No claim is made to invent action-bound approval; runtime enforcement; consent lifecycle; feasibility consent, expressive rule evaluation, or history-aware demonstration. monitoring. The scoped contribution is an executable enterprise contract that allocates approval, release, redemption, I INTRODUCTION AND RESEARCH QUESTION endpoint-coverage, and feedback responsibilities around an An analyst may be entitled to grant application access, yet still agent proposal. It can be encoded in Rego or Datalog; the need a manager to approve access for a particular contractor paper does not demonstrate new logical expressiveness or for seven days. Permission to call the grant tool does not mean superiority over an equivalently configured monitor. that every target, duration, or application is approved. An II METHOD AND DEMONSTRATED SCOPE agent that changes the duration to 30 days after review has produced a different transaction. If execution accepts only The study follows design-science methods [12], [13]: specify 'tapproval exists,' an otherwise valid credential can perform an the problem and artifact, analyze failure cases, exercise an unapproved action. This is the practical gap between standing executable model, and define empirical follow-up. Secure access and specific business consent. development and auditing support controlled policy changes and traceability [14], [15]. A local reference adapter uses AI risk management assigns governance responsibilities [1]. Python and SQLite, with authored identities, policies, Zero trust and attribute-based access control provide explicit approvals, and tool state. It has no LLM, OPA service, authorization foundations [2], [3]. Open Policy Agent (OPA) production identity provider, network endpoint, or real access- evaluates structured inputs using Rego [4], integrates with grant operation. enforcement applications [5], records decisions [6], and distributes policy and data bundles [7]. These established A Requirement mapping and validation capabilities are useful building blocks. A policy result still Each governance requirement maps to its owner, authoritative needs a trusted adapter that enforces its conditions when the attribute, contract field, enforcement point, reason code, and target changes. positive and negative fixture. Examples include changing the AgentGuardian learns context-aware tool policies from staging approved duration, replaying a consumed approval, and failing traces and uses control-flow dependencies [8]. Palumbo et al. a required audit write. The fixtures check internal specify Datalog policies and monitor event graphs against conformance. They were authored with their expectations, not current state and event history [9]. Both overl