AI Agents Ignore Company Security Policies Unless Rules Are Hard-Coded

Most organizations store security and data-handling policies in documents that AI agents never read, leaving those agents unaware of rules around data exports, refund approvals, or regional data restrictions. Simply pasting policy text into an AI agent's system prompt is an inadequate fix, as such instructions can be overridden by prompt injection attacks and are requests rather than enforced controls. A stronger approach converts policy statements into programmatic checks the agent must pass before executing actions — for example, requiring a function call to verify manager approval before processing large refunds. A tool called AgentPolicy aims to automate this conversion, translating policy text into agent-callable compliance checks and mapping them to relevant EU AI Act obligations. The author cautions that generated rules are a starting point requiring human review, and that vague source policies will produce correspondingly vague rules.