Policies control what AI systems are allowed to do at runtime—contracts, guardrails, and budgets before tokens spend.