Rules belong in code

An AI asked nicely to stay under budget usually will. “Usually” isn’t good enough for your money or your customers’ inboxes.

Heraldic · Written October 30, 2026

The first decision in the product’s design: agents never hold your account credentials and never make changes to your ad or email platforms. Every change an agent wants is recorded as a proposal, and ordinary code decides whether it happens, then makes it.

Propose, decide, check again

An agent’s tools can read data and propose actions. Each proposal goes to a policy engine, which is plain code with no AI in it. The engine answers at once with one of three outcomes: the proposal breaks one of your limits and is stopped, with the reason sent back to the agent; it needs your approval and waits in your inbox; or your permission settings allow it to go ahead.

When you approve an action, the policy engine checks your limits again, because things change while an approval waits: spend adds up, and other changes go through. The change is made only if it still passes, by the executor, the one part that can change your accounts, and the result is recorded.

01 · AgentProposesIt never holds your credentials.

02 · Your rulesDecidesPlain code with no AI in it. It can’t be talked past.

BlockedRaise a daily budget 35%Over your 20% limit per change
Needs youSend the running-low emailSending email: you approve
AllowedLower a bid 10%Inside limits: acts and notifies you

03 · The changeActs✓ RecheckedAnything you approved runs the rules again first. Then the executor makes the change.

04 · AccountsYour accountsYour ad and email accounts.

What this gives you

Four things follow from this design, and none of them depends on the AI behaving well.

Banned phrases, matched word for word: an ad or email that uses one is stopped, whatever the agent proposed. Brand review checks the voice rule below them.

Spend caps, the stop-everything switch and permission levels are enforced by code the AI can’t get around.
Every change to your accounts has a trail: who proposed it, why, who approved it and what happened.
Approvals can wait hours or days without holding anything up.
A stopped proposal teaches the agent something: the reason comes back as a plain sentence it can act on. The full story of one is in “Anatomy of a stopped proposal”.

One rule, as it runs

This is the limit per change as the policy engine runs it: a plain comparison the AI never sees and can’t argue with.

A test guards the part that matters most. A setting below the company’s can only make a limit stricter, so a layer that asks for a 50% limit per change still gets the company’s 20%. If a code change ever loosened that, the test would fail.

change = (proposed − current) ÷ current

if |change| > limit per change: stop, and record why

A budget of 100 a day raised to 130: change = 0.30 > 0.20

Recorded: “A 30% change is over your 20% limit per change.”

A lower layer asks for 0.50; the company sets 0.20; the limit is min(0.20, 0.50) = 0.20

All the rules

The product’s other rules work the same way: the stop-everything switch, spend caps, consent, contact limits, banned phrases, and figures that must have a source. The policy engine’s rules, in the order they run, and the checks on every ad and email, each with its default and the words it records, are listed on the rules page, generated from the code that enforces them. Each is tested, and the results are in the test record.

Where prompts still matter

Prompts shape judgment: what to test, what to say, when to wait. They’re the right tool for that. They’re the wrong tool for a limit. A limit that holds only if the AI remembers it isn’t a limit.