Your security policy is a PDF. Your AI agent can't read PDFs.

A developer has released AgentPolicy, a tool that converts company security and data-handling policy text into agent-callable policy checks and a compliance checklist, mapping the output to applicable EU AI Act obligations. The tool is designed to move enforcement from the model's context window into the agent's tool layer, so rules become code the agent must pass rather than text it is asked to respect. The developer cautions that generated checks are a starting point for review, not a reviewed control set, and that the tool does not constitute legal advice.

Most companies I've seen have a security or data-handling policy that lives in a document. It gets written, reviewed, approved, filed away. It's very clear about what an employee may and may not do. Then the company gives an AI agent access to production tools, and the agent has read exactly none of it. The agent doesn't know that customer records shouldn't be exported to personal drives. It doesn't know that refund approvals over a certain amount need a second pair of eyes. It knows what its system prompt says, and the system prompt says "you are a helpful assistant." There's a well-meaning attempt at a fix that goes: paste the policy into the system prompt. It helps a little. It's still just words the model is asked to respect, sitting in the same context window as everything a prompt injection attack tries to override. A rule that lives in the prompt is a request, not a control. The stronger version of that idea: turn the policy into checks the agent has to pass , not text it's asked to remember. "Refunds over $500 require a manager" becomes a function the agent must call before executing a refund. "Customer data stays in the EU region" becomes a validation on the tool's arguments. AgentPolicy https://agentpolicy.lxsaihub.com takes your company policy text and produces agent-callable policy checks plus a compliance checklist, and maps them to the EU AI Act obligations that apply. The output is exportable rules — something you can wire into the agent's tool layer, so the enforcement point is code, not context. The EU AI Act mapping is worth a sentence on its own. If your agent makes decisions about people, some of the Act's obligations probably reach you, and "we have a policy document" doesn't satisfy them by itself. Having the mapping generated alongside the rules means the compliance story and the enforcement story stay in one place instead of drifting apart. It is not legal advice, and I want that in plain text rather than a tooltip. Generated checks are a starting point for your review, not a reviewed control set. A policy-to-rules conversion can also only be as good as the policy text you feed it — vague policies produce vague rules, which is arguably useful feedback about the policy itself. Pick one policy sentence that your team clearly follows. Ask: if an AI agent had the credentials to violate this tomorrow morning, would anything stop it, technically? Not procedurally — technically. If the honest answer is "someone would notice in the audit logs," that's a detection, not a prevention, and the gap is worth closing before an agent shows up to widen it. agentpolicy.lxsaihub.com https://agentpolicy.lxsaihub.com — and if the generated rules miss something your policy clearly says, that's the most useful feedback I can get.