Semantic policy examples for AI agents
Each example is a semantic policy: a rule written in plain English that Alyria enforces around the agent. It decides from what the agent is doing and what has already happened, not just which tool it calls.
Software development
Illustrative exampleCoding agent: Fix a failing test and push the change for ticket ENG-482
Semantic policy
“Deny git pushes after a web search, unless a secure code review agent has verified and validated the code.”
- What happened
- The agent searched the web for a fix, wrote the change, then tried to git push. The code review agent found code nobody asked for.
- What Alyria did
- BlockedThe push was stopped. The agent searched the web earlier in this task, so the push needs a passing review, and this review did not pass.
- Also checked
- Access limited to this ticket's repository and branch. Tests and review rules pass.
- Result
- Once the extra code was removed and the review agent verified and validated the change, the push went through. Merge waits for a reviewer.
Procurement
Illustrative exampleProcurement agent: Order 40 laptops for the new hires
Semantic policy
“If this month's orders with one supplier would go over $50,000 in total, the budget owner approves before the agent places the order.”
- What happened
- The agent prepared a $22,400 order. Earlier orders to the same supplier this month already total $38,000.
- What Alyria did
- Needs approvalThe order is held for the budget owner. With this month's earlier orders the total would be $60,400. A check on this order alone would have let it through.
- Also checked
- Supplier is on the approved list. Within the team's quarterly budget.
- Result
- Order drafted and sent to the budget owner with the running total attached.
Security operations
Illustrative exampleInvestigation agent: Investigate a malware alert
Semantic policy
“An agent may isolate a host only after an analyst confirms the case, and never a production server without the on-call lead.”
- What happened
- Mid-investigation, the agent tried to isolate SRV-DB-04 while the case was still marked suspected.
- What Alyria did
- BlockedIsolation did not run. The case is not confirmed yet, and SRV-DB-04 serves production. Reading logs was allowed; changing the host was not.
- Also checked
- Read-only access to the alert and host history. Evidence attached to the case.
- Result
- The agent built the case with its evidence and asked the on-call analyst to confirm containment.
Financial operations
Illustrative exampleFinance agent: Resolve an invoice that does not match its order
Semantic policy
“If a supplier's bank details changed in the last 30 days, payments to that supplier wait for a call-back verification.”
- What happened
- After fixing the mismatch, the agent scheduled the $18,900 payment. The supplier's bank account changed 6 days ago.
- What Alyria did
- Needs approvalThe payment is on hold. A recent change of bank details is a common sign of invoice fraud. The rule looks at the supplier's history, not just this invoice.
- Also checked
- Invoice, order and receipt matched. The agent that prepared the fix cannot approve it.
- Result
- Mismatch resolved and documented. The payment goes out once finance verifies the new account by phone.
Customer service
Illustrative exampleService agent: Refund a customer for a damaged order
Semantic policy
“Refunds over $100, or a second refund on the same account within 90 days, need a team lead.”
- What happened
- The agent tried to issue an $80 refund on case 55120. This customer received a $60 refund three weeks ago.
- What Alyria did
- Needs approvalThe refund is held for a team lead. The amount is under $100, but it is the second refund in 90 days. The rule uses the account's history.
- Also checked
- Only this customer's records were visible. Identity check completed.
- Result
- Refund prepared and sent to a team lead. The customer was told it is in review.