> ## Documentation Index
> Fetch the complete documentation index at: https://docs.brane.membranelabs.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy-as-Code For AI Agents

> Brane lets developers write Python policy functions that govern AI agent actions before capabilities execute.

Brane is policy-as-code for AI agents. Developers write normal Python functions that inspect an attempted agent action and return a structured decision such as `allow` or `deny`.

The policy runs at runtime before the agent uses a capability, so the policy can block unsafe tool calls, database queries, model calls, MCP tools, memory writes, file access, and other actions.

## What Policy-as-Code Means In Brane

A Brane policy is not a prompt. A Brane policy is application code:

```python theme={null}
from brane import Decision

@runtime.before_capability("refund_customer")
def refund_limit(ctx):
    amount = ctx.arg("amount_usd", 0)
    if amount > 100:
        return Decision(type="deny", reason="Refund exceeds $100 limit")
    return Decision(type="allow")
```

Because policies are Python functions, they can use your application context, tenant settings, environment, risk metadata, scopes, and audit rules.

## Why Policy-as-Code Is Better Than Prompt Rules

Prompt rules are advisory. Policy code is enforceable.

| Approach           | What it can do                           | Limitation                               |
| ------------------ | ---------------------------------------- | ---------------------------------------- |
| Prompt instruction | Tell the model what behavior is expected | The model may ignore or misunderstand it |
| Output filter      | Inspect final text                       | The action may already have happened     |
| Brane policy       | Intercept the attempted action           | Requires registering capabilities        |

Brane policies run before the consequence occurs.

## Policy Inputs

Every policy receives a [PolicyContext](/concepts/policy-context). The context includes:

* The capability being attempted
* The input arguments
* The agent identity
* The principal identity
* The tenant
* The environment
* The capability risk level
* The output for after-capability policies

## Policy Output

Every policy returns a [Decision](/concepts/decision):

```python theme={null}
Decision(type="allow")
Decision(type="deny", reason="Only SELECT queries are allowed")
```

Today, `allow` and `deny` are implemented. Additional decision types such as `approval_required`, `redact`, `transform_input`, and `transform_output` are planned.

## Related Pages

* [Writing Policies](/policy/writing-policies)
* [Before Capability Policies](/policy/before-capability)
* [Decision](/concepts/decision)
* [Refund Limit Recipe](/recipes/refund-limit)