Business Rules - AI Agents

This document lists the fundamental business rules of the AI Agents domain, identified by a unique BR-NNN code. Each rule is technology-independent and describes an invariant constraint on the behaviour of an agentic system.

---

BR-001 - Every Run must have a stop condition

Code: BR-001 Name: Maximum iteration and budget limit per execution Description: Every Run of an Agent must define at least one explicit stop condition: a maximum number of Steps (iterations), a token budget, a time budget or a monetary cost. An agent cannot run an unbounded perceive-decide-act loop. Rationale: Prevent infinite loops, budget exhaustion and runaway costs (the primary risk of an agentic architecture). Priority: CRITICAL Actors: Orchestrator, Operator Violation: the Run is forced into FAILED state with reason max_iterations_exceeded / budget_exceeded. Traceability: INV-02; agent-run-lifecycle.md; ReAct (arXiv:2210.03629).

---

BR-002 - Idempotency of Tool Calls with side effects

Code: BR-002 Name: Actions with side effects must be retry-safe Description: Every Tool that produces external side effects (DB write, email send, payment) must support an idempotency mechanism (e.g. idempotency_key) so that an Agent retry after a timeout does not duplicate the effect. Rationale: Agents retry actions; without idempotency a retry causes duplicated effects (double order, double email). Priority: HIGH Actors: Tool Executor, Orchestrator Traceability: INV-06; tool-invocation.md Alternative Flow.

---

BR-003 - Schema validation before executing a Tool

Code: BR-003 Name: Model-generated arguments must validate against the Tool schema Description: Before invoking a Tool, the Orchestrator must validate the arguments produced by the model (ToolCall.arguments) against the declared Function Schema. Non-conforming arguments (wrong type, missing required field) are not passed to the Tool but returned to the model as a correctable error. Rationale: Models can hallucinate arguments or function names; validation prevents malformed executions and injection. Priority: HIGH Actors: Orchestrator, Tool Executor Violation: ToolValidationFailed → the error message is reintroduced into the context for self-correction. Traceability: BR-006; OWASP LLM Top 10 (LLM01).

---

BR-004 - Grounding required for factual answers

Code: BR-004 Name: Factual claims must be anchored to retrieved context Description: When an Agent answers with factual information about a specific domain, it must base it on verifiable retrieved context (RAG) and not on unverified parametric knowledge. Claims must be traceable to a source (citation, retrieved chunk). Rationale: Reduce hallucinations and ensure faithfulness to sources. Priority: HIGH Actors: Agent, Retriever Traceability: BR-008; RAG (arXiv:2005.11401); rag-retrieval.md.

---

BR-005 - Human approval for high-risk actions

Code: BR-005 Name: Human-in-the-Loop required for irreversible or sensitive operations Description: Actions classified as high-risk (data deletion, spending above a threshold, external communications, production changes) must suspend the Run and require explicit approval from a human Operator before execution. Rationale: Limit the damage of incorrect agent decisions on non-reversible operations. Priority: CRITICAL Actors: Operator, Orchestrator, Guardrail Violation: the action is blocked; the Run enters WAITING_APPROVAL state. Traceability: human-approval.md; agent-run-lifecycle.md WAITING_APPROVAL state.

---

BR-006 - Guardrails evaluate every input and every output

Code: BR-006 Name: Security filtering on user input and model output Description: Every input from an untrusted source (user, web content, tool result) and every output destined for the user or for actions must pass through the Guardrails for detection of prompt injection, harmful content and sensitive data leakage. Rationale: Defend against prompt injection, jailbreak and data exfiltration. Priority: CRITICAL Actors: Guardrail, Orchestrator Traceability: OWASP LLM Top 10 (LLM01, LLM06); INV-05.

---

BR-007 - Context must not exceed the model window

Code: BR-007 Name: Token Budget management and controlled truncation Description: The Orchestrator must ensure that the assembled context (system prompt + memory + history + tool results) does not exceed the model's context window. When approaching the limit, it must apply an explicit strategy (summarisation, truncation of the oldest history, memory compaction), never a silent truncation that drops critical information. Rationale: Avoid overflow errors and quality degradation from loss of relevant context. Priority: HIGH Actors: Orchestrator, Memory Traceability: INV-04; agent-run-lifecycle.md.

---

BR-008 - Every Tool Result re-enters the decision loop

Code: BR-008 Name: The observation of an action feeds the next decision Description: The result (Observation) of every invoked Tool must be reintroduced into the Agent's context before the next decision. The agent cannot plan step N+1 ignoring the outcome of step N. Tool errors are valid observations the agent can recover from. Rationale: Ensure the correct ReAct loop (Reason → Act → Observe) and self-correction capability. Priority: HIGH Actors: Agent, Orchestrator Traceability: ReAct (arXiv:2210.03629); tool-invocation.md; INV-07.