Policy Engine

plog policy check

plog policy check --file policies.yaml
plog policy check --file policies.yaml --policy my-policy  # Run one specific policy

policies:
  - name: tool-result-follows-call
    rules:
      - name: result-after-call
        type: sequence
        when:
          action_type: TOOL_CALL
        expect:
          action_type: TOOL_RESULT
        within: "60s"

policies:
  - name: no-delete-after-read
    rules:
      - name: no-delete
        type: absence
        when:
          action_name: read_file
        deny:
          action_name: delete_file

policies:
  - name: agent-boundary
    rules:
      - name: restricted-actions
        type: boundary
        allow_actions:
          - read_file
          - search

policies:
  - name: must-have-llm-call
    rules:
      - name: require-llm
        type: presence
        scope: session
        require:
          action_type: LLM_CALL

policies:
  - name: rate-limit-api-calls
    rules:
      - name: llm-rate
        type: rate
        per: session
        count:
          action_type: LLM_CALL
        max: 100

policies:
  - name: no-pii-in-output
    rules:
      - name: no-ssn
        type: pattern
        for_field: action_output
        deny_pattern: "\\d{3}-\\d{2}-\\d{4}"

policies:
  - name: business-hours-only
    rules:
      - name: weekday-hours
        type: temporal
        when:
          action_type: TOOL_CALL
        hours: [9, 17]
        days: [1, 2, 3, 4, 5]
        timezone: "America/New_York"

plog policy test --file policies.yaml

{
  "policy": "event-completeness",
  "status": "fail",
  "violations": [
    {
      "policy_name": "event-completeness",
      "rule": "result-after-call",
      "trigger_event": "evt-123",
      "expected_event": "TOOL_RESULT",
      "session_id": "session-456",
      "agent_id": "my-agent",
      "timestamp": "2026-02-17T10:30:00Z",
      "message": "TOOL_CALL without matching TOOL_RESULT",
      "detail": "Expected TOOL_RESULT within 60s of TOOL_CALL at sequence 42"
    }
  ],
  "events_evaluated": 150,
  "timestamp": "2026-02-17T12:00:00Z"
}