The rules that should govern an AI assistant are already written down. They are in your code of conduct, your handbook, your compliance policies. The problem was never deciding what is allowed. It was enforcing it on a system that reads and acts at machine speed. So we turned the document into the enforcement.
Give an assistant access to your systems and it inherits everyone's reach at once. It can read HR, finance, the roster, the drive, and it can combine them in a heartbeat. A person who did that by hand would be violating three policies you already have. The assistant does not know those policies exist.
Your handbook already says the right things. "Personnel, compensation and scheduling records may not be combined to derive who is likely to be let go." "Colleagues may not be ranked by pay." "Material under legal hold is off limits." "Once an assistant has read untrusted content, it may not send data out." These are clear, human sentences written by the people who own the risk, HR, Legal, Security, not by engineering.
Aggrete takes those sentences and turns each into a machine-enforceable rule that runs in front of every tool call. The clause text stays in the file, owned by whoever wrote it. Engineering does not translate policy into code and quietly change its meaning; the clause and its enforcement live together, and every rule must ship an allow test and a deny test or the build fails.
It remembers. The dangerous thing is rarely one question. Asking for the budget is fine. Asking for the roster is fine. Asking a third question that combines them into a layoff list is not. Aggrete keeps per-person memory across the session, so it catches the pattern that only appears when several harmless calls add up.
It is deterministic. No model sits in the decision. The same request gets the same answer every time, and it is refused before the upstream is contacted, so the forbidden data is never even fetched. You get an answer you can defend to an auditor, with the clause, the owner, and a tamper-evident log line.
The result reads less like a security product and more like your own conduct policy, made real. The handbook stopped being a PDF nobody enforces and became the thing standing between a well-meaning assistant and a problem you already knew you had.
uvx aggrete --demo for a governed sandbox. The engine and the sample policy are on GitHub, Apache-2.0.Aggrete is Apache-2.0 and runs on a laptop or a cluster. Star it, fork it, and tell us what rule to build next.