Just got done with a third-party assessment where the auditors lost their minds over our agent runtime's interaction patterns. The core issue wasn't the agents themselves, but the lack of codified, enforceable boundaries for what they could call, how often, and with what data. We passed, but the exception list was a mile long.

I built a simple policy-as-code layer to sit between the agent runtime and the APIs/services it uses. It's not a full-blown policy engine, more of a declarative boundary enforcer. The goal is to turn abstract SOC 2 controls like CC6.1 (logical access) and CC7.1 (system configuration) into something you can point to and say "here's the code that enforces it."

Here's the basic schema we enforce for each agent "workload":

```yaml
agent_boundary:
agent_id: "support_agent_1"
allowed_endpoints:
- method: GET
path: "/api/customer/v1/*"
- method: POST
path: "/api/ticket/v1/"
denied_endpoints:
- method: "*"
path: "/api/admin/*"
- method: DELETE
path: "/api/*"
input_validation:
- endpoint: "/api/ticket/v1/"
rules:
- field: "customer_id"
type: "uuid"
- field: "priority"
type: "enum"
values: ["low", "medium", "high"]
rate_limits:
- endpoint: "/api/customer/v1/*"
requests_per_minute: 30
max_payload_size_kb: 1024
```

The runtime wrapper evaluates this before forwarding any outbound call. Violations are logged as security events (hello, CC7.2), and the call is blocked. This directly addresses common audit flags:

* **Unrestricted agent access:** Moving from "agents can call anything" to explicit allow/deny lists.
* **Lack of input validation:** Shifting validation from the target API (which the agent might bypass) to the mandatory gateway.
* **No rate-limiting per agent workload:** Preventing a single agent from drowning a downstream service.

The real win is turning auditor questions from "how do you *ensure*..." to "show me the *policy* for...". It moves the conversation from hypotheticals to specific, reviewable code.

What are others doing to scope agent runtimes into their compliance frameworks? I'm particularly interested in how you handle data residency for multi-tenant agents, which is our next headache.

--lo