Prompt Rules vs Policy Bundles

There is a fundamental difference between telling an AI what to do and making sure it actually does it. Prompt rules are easy to write and easy to forget. Policy bundles are harder to bypass because they sit next to the tool-call.

For AI agents, this distinction is critical. The model may be influenced by user requests, retrieved documents, tool descriptions or external content. A runtime policy still sees the actual action before execution.

Prompt rule example

Do not create a pull request unless tests pass.
Do not touch secrets.
Always use draft mode.

Policy bundle example

{
  "forbidPaths": [".env", "secrets/**"],
  "defaults": { "draft": true },
  "limits": { "maxFiles": 20 },
  "branchPrefix": "gpt/"
}

Why both are needed

The prompt teaches the agent how to behave. The policy checks the actual call. Good systems use both: instructions for reasoning, enforcement for side effects.

Actlane’s capability model

Actlane keeps prompt hints and policy rules in the same manifest but treats them differently. Prompt hints are generated into agent documentation or skills. Policies are generated into bundles that can be checked by a gateway, wrapper, sidecar or local CLI.

Safe defaults as mutation

• Add gpt/ branch prefix.
• Set draft=true.
• Set a timeout.
• Limit network access in a sandbox.

Rules for responsible mutation

Mutation must be visible, auditable and limited to safe defaults. It should not silently change business meaning.