Automated Policy Generation from Incidents

Every safety incident reveals a gap in your policy. If an agent performed an unauthorized action, a missing or insufficient rule allowed it. Automated policy generation analyzes incident data and proposes new rules that would have prevented the incident. This closes the loop between detection and prevention.

The Feedback Loop

The process follows a cycle: an incident occurs, the incident is analyzed, a policy rule is proposed, the rule is reviewed and approved, and the rule is deployed. Automation accelerates the analysis and proposal steps, which are the most time-consuming parts of the cycle.

Incident Analysis

For each incident, extract the action envelope that caused or enabled the harm. Identify the action type, resource, principal, and any conditions that were present. Then determine what rule would have blocked the action.

Incident: Agent exported customer PII to external API
Action: data.export
Resource: customers/pii/*
Destination: external-analytics.com
Missing rule: deny data.export to external destinations for PII resources

Rule Proposal

Generate a candidate rule that addresses the gap:

proposed_rule:
  source_incident: "INC-2025-0892"
  action: "data.export"
  conditions:
    resource_classification: "pii"
    destination_type: "external"
  effect: "deny"
  confidence: "high"

Confidence Scoring

Not all proposed rules are equally reliable. Score each proposal based on how clearly the incident maps to a missing rule. High confidence proposals address clear policy gaps. Low confidence proposals may be edge cases where a blanket rule would cause excessive false positives.

Human Review

Automated proposals should never be deployed without human review. Present proposals to the policy team with full incident context, expected impact analysis (how many past actions would this rule have affected), and false positive estimates. The team approves, modifies, or rejects each proposal.

Pattern Detection

Beyond individual incidents, analyze incident patterns to identify systemic gaps. If multiple incidents involve data exfiltration through different tools, the systemic fix might be a broad egress control policy rather than individual tool-level rules.

Integration with Authensor

Authensor's receipt chain provides the structured data needed for automated analysis. Every action envelope, policy decision, and audit receipt is queryable. Pattern detection queries can run against this data to identify recurring gaps and generate batch proposals.

Turn every incident into a stronger policy. Automation makes this practical at scale.