A policy = org context + rules
A policy is your compliance context plus a set of rules. One active policy per org applies. Each rule has a title and aguidance string, plus optional good/bad example pairs. Two
things to know:
- There is no severity field. A flag is a flag; any confirmed violation blocks. You don’t rank rules by severity; you write them so each one only fires when it should.
- The guidance must carry both halves. Every rule states what to flag and the carve-out — “flag X, but do NOT flag Y.” A rule with only the flag half over-flags; the carve-out is what keeps the judge on the line you actually mean.
The policy is the prompt
There’s no hidden rulebook. The judge’s prompt is assembled entirely from the policy: a system role (“an impartial legal/compliance reviewer for marketing content in a regulated industry”), then your## Organization context, then ## Rules (each rule with its good/bad examples), then the
## Content to review. Nothing else feeds the decision — which is why calibrating the policy is how
you calibrate the judge. (See Calibrate the guardrail.)
What it returns, and the verdict rule
The judge returns a list of violations, each with the rule it breaches, the offending excerpt, an explanation, and a suggested fix. The verdict is simple: status isfail if there’s at least one
confirmed violation; otherwise it passes with an empty violation list. Clean content comes back
empty: the guardrail gates content, so it doesn’t hand back a list of everything that was fine.
