What is a Compliance Rule?

AI agents operating through MCP tools can access databases, trigger API calls, modify infrastructure, and process sensitive data. Without compliance rules, each of these operations is a potential regulatory violation waiting to happen. A coding agent that queries a production database might inadvertently access personally identifiable information in breach of GDPR. A DevOps agent might modify cloud infrastructure without the change management process required by SOC 2.

Compliance rules translate legal and organisational obligations into machine-enforceable constraints. Rather than relying on the LLM to 'know' it shouldn't access EU customer data without a lawful basis, a compliance rule explicitly blocks or restricts the tool call at the proxy layer. This is defence in depth — the agent's own reasoning is not trusted as a compliance control.

The distinction between a general policy rule and a compliance rule is intent and traceability. Compliance rules map directly to specific regulatory requirements or internal control objectives. When an auditor asks 'how do you prevent agents from accessing health records without authorisation?', the answer is a specific, version-controlled compliance rule with a clear audit trail of when it was created, reviewed, and last modified.

PolicyLayer enforces compliance rules as conditions in the policy document, evaluated on every MCP tool call. Each rule can target specific tools, arguments, or patterns — for example, blocking database queries that match PII column names, or requiring approval for any tool call that touches a production environment. Because each policy is a single structured document validated when it is saved, every compliance rule is reviewable in one place and can be mapped to specific regulatory requirements in audit documentation.