Policy as Intent: Compiling Intent into Enforceable Runtime Guardrails and Where It Fails Open

Abstract

A declared intent is inert until it is turned into something that actually stops an action at runtime. This article develops that compilation: how the parts of an intent — hard constraints, a bounding scope, and a graded goal — become concrete guardrails enforced at a policy enforcement point that intercepts the agent's actions, and how those guardrails compose with the identity and access decisions beneath them. Its central concern is failure. A guardrail can fail open — allowing an action it should have stopped — wherever the intent is silent, a check is undecidable, or an action reaches a resource the enforcement point never saw. The article maps these fail-open surfaces precisely and argues for fail-closed-by-construction enforcement, in which ambiguity denies or escalates rather than permits. The key takeaway is that intent-based governance is only as strong as the completeness of its interception and the fail-safety of its guardrails; an enforcement point that fails open where the intent is silent provides the appearance of governance without the substance.

Between a declared intent and a governed agent sits a compiler and an enforcer. The compiler turns the intent's goal, constraints, and scope into concrete rules; the enforcer sits in the path of the agent's actions and applies those rules to each one before it takes effect. Skip either and the intent governs nothing — a beautifully specified intent that no runtime component consults is a document, not a control. But building the compiler and enforcer surfaces a harder question than 'how do we enforce the intent?' It is 'what happens when the intent has nothing to say about an action, or the check cannot decide, or the action slips past the enforcer entirely?' Those are the fail-open surfaces, and they, not the happy path, determine whether the governance is real. This article builds the enforcement machinery and then spends most of its effort on where and why it fails open, because that is where governance is actually won or lost.

From Declared Intent to Runtime Guardrail

Enforcement borrows a clean separation from zero-trust architecture. NIST SP 800-207 distinguishes a policy decision point — the component that decides whether a request should be allowed — from a policy enforcement point, the component in the request's path that actually permits or blocks it. Intent-based governance reuses this split: the declared intent is compiled into rules the decision point evaluates, and the enforcement point sits at the agent's action boundary — the point where it invokes a tool or touches a resource — and applies the decision before the action takes effect.

The enforcement point's placement is the whole game. It must sit where every consequential action passes, because an action that does not pass through it is an action the governance never sees and therefore never governs. For an agent, the natural boundary is the tool-call interface: every external effect the agent has — every API call, file write, message sent — should be mediated, so that the enforcement point can evaluate each against the compiled intent. An agent that can reach a resource without crossing the enforcement point has a hole in its governance exactly the size of that path.

Compilation is the step that makes the intent enforceable rather than merely readable. A constraint compiles to a rule the decision point can evaluate as a hard block; a scope compiles to a membership test that flags out-of-scope actions; a goal compiles to a conformance monitor that scores alignment. The compiled artifact is what the enforcement point actually runs, and its fidelity to the declared intent is a property to verify — a compiler that silently drops a constraint produces a guardrail that permits what the intent forbids, and the failure is invisible until exercised.

The intent compiles into rules a decision point evaluates; the enforcement point mediates every agent action.

Compiling Each Part of the Intent

The three governing parts of an intent compile into three different kinds of guardrail, and keeping them distinct is what makes enforcement both strong and analyzable. A hard constraint compiles to a blocking rule: a decidable predicate over the proposed action and its context that, if it evaluates to violated, denies unconditionally. These are the strongest guardrails because they are unambiguous and cheap, and they should carry as much of the governing weight as possible. A scope compiles to an allow-condition: the action is checked for membership in the declared set of resources and action types, and anything outside is treated as presumptively off-intent — denied or escalated, not silently allowed.

The goal is the part that cannot compile to a hard rule, and pretending otherwise is a mistake. Because service to a goal is graded, the goal compiles to a conformance monitor that produces a score, not a verdict, and the enforcement point must decide what to do with a score. A high score proceeds; a clearly low score denies or escalates; and the uncertain middle is exactly where governance is hardest and where the fail-open risk concentrates. This is why the earlier parts matter so much: every action a hard constraint or scope rule can decide is one the fuzzy goal monitor never has to adjudicate.

Compilation also has to preserve the composition with the layers beneath. The enforcement point's verdict is the conjunction of permission, constraint-respect, scope-membership, and adequate goal-conformance; an action must clear all of them. Order matters for cost and clarity — evaluate the crisp, decisive checks first and reach the graded goal judgment only for actions that survive them — but the semantics are a conjunction: any single failing guardrail denies, and no guardrail can override a denial from a lower layer.

How each part of an intent compiles into a runtime guardrail.
Intent part	Compiles to	Verdict
Hard constraint	Blocking predicate	Violated -> deny unconditionally
Scope	Membership allow-condition	Out-of-scope -> deny / escalate
Goal	Conformance monitor	Score -> proceed / escalate / deny
(composition)	Conjunction of all + access control	Any failure -> deny

Where It Fails Open

A guardrail fails open when it permits an action it should have stopped, and for intent-based governance there are three distinct surfaces where this happens. The first is silence: the intent says nothing about the dimension the action lies on, so there is no constraint to violate and no scope rule to fail, and the action sails through by default. This is the intent-action gap expressed at enforcement time — where the specification is blind, the guardrail is permissive. The second is undecidability: the goal-conformance score lands in the uncertain middle, and if the enforcement point resolves uncertainty by allowing, it fails open precisely on the hardest cases. The third is unmediated action: the action reaches a resource by a path the enforcement point does not sit on, so no guardrail evaluates it at all.

These surfaces are dangerous because each is invisible on the happy path. A governance system tested only on clearly on-intent and clearly off-intent actions looks perfect, because those are exactly the actions the guardrails decide confidently. The failures live in the silent dimensions, the uncertain scores, and the unmediated paths — none of which a naive test exercises. The result is a system that appears to govern while leaving open the very cases an adversary or a drifted agent will find, since those actors are precisely searching for where the standard is silent or the enforcer absent.

Naming the three surfaces turns 'is our governance sound?' into three answerable questions. Are there dimensions the intent is silent on that we treat as permitted? Does an uncertain conformance score resolve to allow or to deny? Is there any action path that does not cross the enforcement point? Each has a fail-closed answer, and the difference between a governance system that protects and one that merely reassures is whether all three are answered in the fail-closed direction.

The same three surfaces resolve safely or dangerously depending on how ambiguity is handled.

Fail-Closed by Construction

The remedy for all three surfaces is the same principle applied three ways: design the enforcement so that ambiguity denies or escalates rather than permits. For silence, the default is deny — an action on a dimension the intent does not cover is treated as presumptively off-intent and blocked or sent for review, rather than allowed because no rule objected. This inverts the dangerous default: instead of 'permitted unless a rule forbids it', the posture becomes 'off-intent unless the intent affirmatively covers and permits it'. That inversion is the single most important design choice in the whole model.

For the uncertain conformance score, fail-closed means the middle band escalates. Rather than forcing a graded score into a binary allow, the enforcement point routes genuinely uncertain actions to a human or a stricter check, converting the fuzziest decisions into supervised ones instead of guessed ones. This costs latency and human attention, which is why the crisp guardrails matter — they keep the escalation volume low enough that the uncertain cases which remain can actually receive attention. An enforcement point that escalates everything is as useless as one that allows everything; the design goal is to make hard constraints and scope carry the bulk, leaving a tractable stream of genuinely hard cases for the graded judgment.

For the unmediated path, fail-closed means completeness of interception is a hard requirement, not a best effort. Every consequential action must cross the enforcement point, which in practice means the agent is given no capability to reach a resource except through the mediated boundary. This is the enforcement analogue of least privilege: the agent's environment is arranged so that the only way to have an external effect is the governed way. A single un-mediated capability is a fail-open path that no amount of guardrail sophistication elsewhere can compensate for.

Fail-closed design pushes every quadrant toward deny or escalate rather than silent allow.

The Interception Point Must Be Complete

Of the three fail-open surfaces, the unmediated path deserves its own treatment because it defeats governance most completely and most silently. A guardrail can only evaluate actions it sees, so the set of actions the enforcement point mediates is the exact set governance covers. Any action that reaches a resource without crossing that point is ungoverned, regardless of how carefully the intent was specified or compiled. The trust boundary of the whole system is drawn precisely at the enforcement point, and anything that flows around it is outside the boundary.

The failure is subtle because it is architectural, not logical. The rules can be perfect and the intent complete, yet if the agent retains any capability — a direct network egress, an unmediated file handle, a tool that itself calls other tools without re-mediation — that reaches a resource off the enforced path, the governance simply does not apply there. Agentic systems are especially prone to this because agents compose capabilities dynamically; a tool that spawns a sub-process, or an action whose side effects trigger further effects outside the mediated interface, creates exactly such a path. The OWASP Agentic guidance's attention to excessive agency is, at root, attention to capabilities an agent holds that its governance does not fully see.

The discipline is to make the enforced boundary the only boundary. Every capability the agent has to affect the world is routed through the enforcement point, and the agent is deprived of any capability that would let it act otherwise. Then the set of governed actions equals the set of possible actions, and the interception is complete. Verifying this is its own task — an inventory of the agent's capabilities checked against the mediated interface — and it is as important as verifying the intent, because a complete intent enforced over an incomplete boundary governs only the part of the agent's behavior that happens to pass through.

The enforcement point is the trust boundary; any unmediated path is ungoverned by construction.

Limitations and Threats to Validity

This article describes an enforcement design and its failure surfaces, not a measured implementation, and its guarantees are conditional on the design being realized faithfully. The strongest condition is completeness of interception, which is an architectural property that must be established and continuously re-verified as an agent's capabilities evolve; a system correct at deployment can develop a fail-open path the first time a new tool is added without routing it through the enforcement point. Fail-closed defaults, likewise, trade safety for availability and human attention — a system that denies on silence and escalates on uncertainty will deny and escalate more, and if the crisp guardrails do not carry enough load, that cost can be high enough to pressure teams back toward fail-open, which is exactly the wrong direction.

Two further dependencies bound the result. The compiled guardrails are only as faithful as the compiler; a compilation that drops or weakens a constraint produces confident-looking enforcement of a rule that no longer means what the intent said, so the compiler itself is part of the trust base and deserves verification. And the goal-conformance monitor at the heart of the uncertain-middle problem is imperfect and can be gamed by actions engineered to score as aligned, so escalation thresholds must be set with that adversarial possibility in mind. None of this diminishes the core point; it sharpens it. Intent-based governance becomes real only at the enforcement point, its strength is bounded by the completeness of interception and the fail-safety of its guardrails, and an enforcement point that fails open where the intent is silent delivers the appearance of governance while leaving the substance to chance.

Key takeaways

Intent governs nothing until it is compiled into guardrails enforced at a policy enforcement point that sits in the path of every agent action, reusing the decision-point/enforcement-point split from zero-trust.
Each part compiles differently — hard constraints to blocking predicates, scope to a membership allow-condition, the goal to a conformance monitor that yields a score — and the verdict is the conjunction of all with access control.
Guardrails fail open on three surfaces: silence (the intent covers nothing there), undecidability (the conformance score is uncertain), and unmediated action (the enforcer never sees it).
These failures are invisible on the happy path, because confidently on- and off-intent actions are exactly the ones the guardrails decide well; the danger lives in the silent, uncertain, and unmediated cases an adversary seeks out.
Fail-closed by construction is the remedy: deny by default on silence, escalate the uncertain middle, and require complete interception so no action reaches a resource off the enforced path.
Completeness of interception makes the enforcement point the trust boundary — the set of governed actions equals the set the enforcer mediates, so a single unmediated capability is a fail-open hole no rule can close.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

✅Enforcement fail-safety checklistchecklist

Confirm the guardrails deny where they must before they gate production actions.

Every consequential agent action crosses the policy enforcement point; a capability inventory confirms no unmediated path exists.
Silence fails closed — an action on a dimension the intent does not cover is denied or escalated, not allowed by default.
An uncertain conformance score escalates to a human or stricter check rather than resolving to allow.
Hard constraints and scope carry the bulk of decisions, keeping escalation volume tractable.
The verdict is a conjunction — permission AND constraint AND scope AND conformance — and no guardrail overrides a lower-layer denial.
The compiler is verified to preserve every constraint; a dropped or weakened rule is treated as a governance defect.

🔒Fail-closed enforcement rule (illustrative)policy

A decision that denies on silence and escalates on uncertainty.

decide(action, ctx, intent):
  if not permitted(action, ctx):        return DENY      # access-control floor
  if violates_any_constraint(action):   return DENY      # hard predicate
  if not in_scope(action, intent):      return ESCALATE  # off-intent by default
  score = conformance(action, intent.goal)
  if score >= high:                     return ALLOW
  if score <= low:                      return DENY
  return ESCALATE                        # uncertain middle -> human
# default posture: off-intent unless affirmatively covered AND permitted

Evaluated by the enforcement point for every mediated action.

🚀Minimum viable enforcement — do these firstquickstart

The smallest path from a written intent to guardrails that actually fail safe.

Place a policy enforcement point at the agent's tool-call boundary and route every external effect through it.
Compile hard constraints to blocking predicates evaluated before anything graded.
Make the default deny: an action outside declared scope, or on a dimension the intent is silent on, is denied or escalated.
Send the uncertain conformance middle to human review, and inventory the agent's capabilities to prove no unmediated path exists.

Glossary

Policy decision point: The component (from NIST SP 800-207) that decides whether a request should be allowed, here by evaluating rules compiled from the declared intent.
Policy enforcement point: The component in an action's path that actually permits or blocks it; for an agent, placed at the tool-call or resource boundary.
Compilation (of intent): Turning an intent's constraints, scope, and goal into concrete runtime rules the decision point can evaluate and the enforcement point can apply.
Conformance monitor: The compiled form of a goal — a component that scores how well an action serves the declared objective, producing a graded signal rather than a verdict.
Fail open: Permitting an action that should have been stopped, occurring where the intent is silent, a check is undecidable, or the action is unmediated.
Fail closed: Resolving ambiguity toward denial or escalation rather than permission, so silence denies, uncertainty escalates, and unmediated paths are eliminated.
Completeness of interception: The property that every consequential agent action crosses the enforcement point, so the set of governed actions equals the set of possible ones.
Unmediated capability: Any means by which an agent can affect a resource without crossing the enforcement point, creating a fail-open path outside governance.