Skip to main content
Rules are plain-language sentences a workspace sets to restrict what an agent may do. Setting one returns its classification on the same call: enforced, a gate that blocks the action, or guidance, only present in the prompt. You always know which kind you actually have, rather than assuming.
Read them back with rules.get, and again the class is the answer, not the text: a rule you thought was a hard gate might come back as guidance, with the reason it could not be compiled into one.
Unlike secrets, rules does carry an MCP tool. The worst an assistant can do with this surface is narrow its own permissions, the opposite risk a credential poses, so an assistant reading rules.get can also tell a person “you think that is enforced and it is not”, which is the whole point of the split.