A study on AI agent safety found that while developers provide numerous behavioral rules, turning these into enforceable system policies is challenging. The Act Plane paper analyzed 2,116 statements from 64 code repositories, revealing that 64% are policies dictating agent actions, while 36% provide descriptive context. These policies often depend on factors like repository structure, task progress, or prior events, making them difficult to enforce with simple OS-level hooks.

The research categorized policies based on enforcement needs: semantic-only, content-based, per-event, and cross-event. Only 45% of policies are OS-enforceable (per-event and cross-event). Crucially, 83% of policies are "system-observable," meaning they require more than just observing a single event. Cross-event policies, which involve temporal ordering or data lineage, are particularly prevalent in the "Development Process" category.

Context dependence further complicates enforcement. Only 26.4% of system-observable policies are self-contained; the majority require project-specific (64.2%) or task-specific context. Policies requiring state tracking across events are also the least likely to specify concrete commands. Effective AI agent policy enforcement necessitates compiling repository and task context into concrete state for deterministic checks, moving beyond simple rule sets.