Writing an AI agent policy is the easy part. Proving it's enforced is the part most teams skip. If you run coding agents with filesystem, network, or credential rules, here are five checks to run before you trust those rules on real work.
On September 25, 2026, GitHub shipped a validator for Copilot's enterprise managed settings, because malformed JSON and unsupported settings "can prevent policies from being enforced." That's the whole problem in one sentence: a policy file can be wrong, and nothing tells you.
1. Validate the config, then prove it loaded. A file that parses isn't a policy that applied. After every policy change, start a fresh agent session and check its logs or settings view for the rules it actually loaded. If you can't see the policy from the agent's side, you don't know it's there.
2. Try to break it on purpose. Have the agent read a denied folder, reach a blocked domain, and use a credential it shouldn't have. Each attempt should fail loudly. Keep these attempts in a script, so they run after every change instead of once at setup. A rule that passed at setup can quietly stop applying after a tool update.
3. Check what happens when enforcement isn't possible. Some tools fall back to running unsandboxed when the operating system can't apply a rule. You want the opposite. GitHub's local sandboxing in the Copilot app, released September 23, 2026, fails with an error instead of running without the sandbox. Find out which way your tool goes before an agent finds out for you.
4. Know where the policy doesn't reach. That same Copilot sandbox doesn't apply to cloud sessions or remote hosts. Most agent tools have a gap like this. List every place an agent can run, and mark which ones your policy covers. The unmarked ones are where your exposure is.
5. Set the defaults before the vendor does. Starting October 22, 2026, Copilot features that an enterprise leaves unconfigured, MCP servers included, follow its global default policy. Pick that default yourself. An unset option is a decision someone else made for you.
None of this replaces containment at the environment level. It checks that the containment you built is really there. We build agentic delivery pipelines on client systems, and the broader setup is in how to contain AI agents without a platform team. Our AI automation work builds these checks in from the first day.