agent failed to detect the policy violation: cached the old policy version

TL;DR

The agent cached the policy and kept auditing against the old version after the policy changed. Check the policy version (or hash) at the start of every run, refresh the cache when it differs, and record which policy version each audit used.

Error

agent failed to detect the policy violation: cached the old policy version

Steps

1. Add a version identifier to the policy: a version number, timestamp, or content hash. Expected: the policy carries something comparable.
2. At run start, fetch the current version identifier and compare it to the cached one. Expected: a match means the cache is fresh.
3. On mismatch, reload the full policy into the cache before auditing anything. Expected: the run evaluates against the current policy.
4. Record the policy version on every audit verdict. Expected: each finding is traceable to the policy version that produced it.
5. Set a maximum cache age as a backstop (for example, 24 hours) in case version checks fail. Expected: the cache can never go arbitrarily stale.

When to use

• An agent misses violations that the current policy would catch.
• The policy changed recently and the agent was not restarted.

When not to use

• The ruleset file itself is corrupt (see the ruleset-recovery skill).
• The policy is current but the rule logic is wrong (tune the rule).

Tool compatibility

• Custom audit agents with cached policy documents.

Variant phrasings

Audit used outdated policy

Same failure, plain wording.

Stale policy cache caused missed violation

Names the cache as the cause.

Why it happens

Policies change on human schedules while agents cache aggressively for speed. Without a version check, the cache silently outlives the policy it copied.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_tqkNmuEG4wfAlG0RNg8lNw