Agent Policy Engine

Say you let an AI agent book travel with your card. You might approve a policy like “flights under $600, only these airlines, never more than two bookings a week.” The agent can plan however it likes, but every purchase it proposes goes through the policy engine first. If the request breaks a rule, it is refused, no matter how persuasive the agent’s reasoning was.

This matters because an AI agent is probabilistic: the same instruction can produce different actions, and a prompt injection can push it toward actions you never intended. A policy engine turns fuzzy intent into a deterministic boundary, which is the agent version of least privilege.

In episode 65 at 2:28, Ledger CTO Charles Guillemet names the policy engine as one of two main security problems for agents that make financial transactions; the hard part, he says, is formalizing intent so it matches a specific action. At 9:24 he proposes that users sign their policy with a hardware device so the engine knows it came from them, that the engine run inside a trusted execution environment or be checked with a zero-knowledge proof, and that signing keys live in a secure enclave that only signs after the engine approves. That design is Guillemet’s recommendation as CTO of a hardware wallet company, not an established standard. The general idea of a policy engine deciding whether to grant access also appears in NIST’s zero trust architecture guidance, which applies it to users and devices rather than agents.