Start From Rules That
Already Make Sense.

Refunds above the limit wait for a support lead. Smaller ones settle by policy.

Why: Most refund volume is small and routine. A single threshold removes the bulk of reviews without exposing large payouts.

{
  "priority": 12,
  "match": {
    "action_types": [
      "payments.refund"
    ],
    "min_amount": 250
  },
  "reason_code": "LARGE_REFUND"
}

Support agents can read public articles and internal tickets without review.

Why: Reads of non-sensitive support content are the highest-volume, lowest-risk thing a support agent does.

{
  "priority": 80,
  "match": {
    "action_types": [
      "kb.*",
      "ticket.*"
    ],
    "operations": [
      "read"
    ],
    "sensitivity": [
      "public",
      "internal"
    ]
  },
  "reason_code": "SUPPORT_READ"
}

Any email or message leaving the company waits for a person.

Why: Outbound messages are irreversible and carry your brand. Start strict; loosen per template once you trust the agent.

{
  "priority": 20,
  "match": {
    "operations": [
      "send"
    ],
    "destinations": [
      "external"
    ]
  },
  "reason_code": "EXTERNAL_SIDE_EFFECT"
}

Any movement of money waits for a finance approver.

Why: Payments are irreversible. Pair with a separate allow policy for small, known vendors only after review data supports it.

{
  "priority": 10,
  "match": {
    "operations": [
      "transfer"
    ]
  },
  "reason_code": "FUNDS_MOVEMENT"
}

Large transfers are blocked outright and must go through your normal payment process.

Why: Some limits should not be negotiable inside an agent workflow, even with approval.

{
  "priority": 0,
  "match": {
    "operations": [
      "transfer"
    ],
    "min_amount": 50000
  },
  "reason_code": "TRANSFER_LIMIT"
}

Finance agents can read internal ledger data without review.

Why: Reconciliation and matching are read-heavy. Approving reads trains reviewers to click yes.

{
  "priority": 80,
  "match": {
    "action_types": [
      "ledger.*"
    ],
    "operations": [
      "read"
    ],
    "sensitivity": [
      "public",
      "internal"
    ]
  },
  "reason_code": "LEDGER_READ"
}

Deletes and security changes in production are blocked unless you add a break-glass policy.

Why: The single rule most worth having on day one.

{
  "priority": 0,
  "match": {
    "operations": [
      "delete",
      "admin"
    ],
    "environments": [
      "production"
    ]
  },
  "reason_code": "DESTRUCTIVE_PRODUCTION"
}

Agents may change non-sensitive resources in staging and sandbox without review.

Why: Lets infrastructure agents do real work where mistakes are cheap.

{
  "priority": 70,
  "match": {
    "operations": [
      "write"
    ],
    "environments": [
      "staging",
      "sandbox"
    ],
    "sensitivity": [
      "public",
      "internal"
    ]
  },
  "reason_code": "NONPROD_WRITE"
}

Exports of 1,000 records or more go to security for review.

Why: Bulk export is the most common path for accidental data leaks.

{
  "priority": 15,
  "match": {
    "operations": [
      "export"
    ],
    "min_records": 1000
  },
  "reason_code": "BULK_EXPORT"
}

Reading restricted records, such as health or payment data, needs approval.

Why: Regulated data access should leave a named human decision in the audit trail.

{
  "priority": 18,
  "match": {
    "operations": [
      "read"
    ],
    "sensitivity": [
      "restricted"
    ]
  },
  "reason_code": "RESTRICTED_READ"
}

Reading credentials or private keys is blocked outright.

Why: Agents should never handle raw secrets. Give tools their own credentials behind the enforcement point instead.

{
  "priority": 0,
  "match": {
    "sensitivity": [
      "secret"
    ]
  },
  "reason_code": "SECRET_ACCESS"
}

Granting or changing access anywhere needs approval, in every environment.

Why: Privilege changes are how small incidents become large ones.

{
  "priority": 5,
  "match": {
    "action_types": [
      "iam.*",
      "access.*"
    ]
  },
  "reason_code": "ACCESS_CHANGE"
}

Sales agents can add notes and tasks to internal CRM records without review.

Why: Logging activity is reversible and internal, and high volume.

{
  "priority": 60,
  "match": {
    "action_types": [
      "crm.note.*",
      "crm.task.*"
    ],
    "operations": [
      "write"
    ],
    "destinations": [
      "internal"
    ],
    "sensitivity": [
      "public",
      "internal"
    ]
  },
  "reason_code": "CRM_ACTIVITY"
}

Enrolling prospects in outbound email sequences needs approval.

Why: Bulk outreach is irreversible and touches compliance rules on consent.

{
  "priority": 20,
  "match": {
    "action_types": [
      "sequence.*",
      "campaign.*"
    ],
    "operations": [
      "send",
      "write"
    ]
  },
  "reason_code": "OUTBOUND_SEQUENCE"
}