Time-Based Policy Rules for AI Agents

Not all actions should be available at all times. Financial transactions might be restricted to business hours. Batch processing jobs might be limited to off-peak windows. Maintenance operations might require a scheduled change window. Time-based policy rules add a temporal dimension to access control.

Time Windows

The simplest time-based rule defines a window during which an action is allowed. Outside the window, the action is denied.

rules:
  - action: "payment.process"
    conditions:
      time_window:
        days: ["mon", "tue", "wed", "thu", "fri"]
        hours: { start: "09:00", end: "17:00" }
        timezone: "America/New_York"
    effect: "allow"

This rule allows payment processing only on weekdays during business hours Eastern time.

Cooldown Periods

Cooldown rules prevent an agent from repeating a sensitive action too quickly. After executing a high-risk action, the agent must wait a specified duration before executing it again. This limits the damage from automated attack loops.

rules:
  - action: "data.export"
    conditions:
      cooldown: "15m"
    effect: "allow"

Rate Windows

Rate-based rules limit how many times an action can be performed within a rolling window. This is different from simple rate limiting because it is expressed in policy and can vary by action, agent, and context.

Expiring Permissions

Temporary permissions that automatically expire are useful for break-glass scenarios. An operator grants an agent elevated access for a defined period. When the period ends, the permission disappears without requiring manual revocation.

Timezone Considerations

Always specify timezones explicitly in time-based rules. An agent running in one timezone evaluating a rule written for another timezone will produce incorrect results. Store all times in UTC internally and convert to the specified timezone during evaluation.

Implementation in Authensor

Authensor's policy engine evaluates time conditions synchronously by comparing the envelope timestamp against the rule's time constraints. The engine receives the current time as an input parameter, making time-based rules fully testable with deterministic timestamps.

Time-based rules add precision to your policies. Use them to match your safety controls to your operational reality.