agent broke the audit ruleset while patching a policy threshold
Recovers from agent-corrupted audit rulesets with versioned rules and dry-run validation. Use when an agent's ruleset edit breaks auditing. Not for intended rule changes that produce unwanted verdicts.
TL;DR
The agent edited the live ruleset and broke it. Restore the last known-good version, make future edits against a copy, validate the edited ruleset in dry-run before promoting it, and require the validation to pass before any edit goes live.
Error
agent broke the audit ruleset while patching a policy thresholdSteps
- Immediately restore the last known-good ruleset version from version control. Expected: auditing works again on the good rules.
- Diff the broken version against the good one. Expected: the exact edit that broke it is visible.
- Fix the edit in a copy: correct the threshold syntax or structure. Expected: a candidate ruleset that looks right.
- Validate the candidate in dry-run against a labeled set of past expenses. Expected: verdicts match the expected outcomes.
- Only then promote the candidate to live, keeping the good version tagged for instant rollback. Expected: the change is live with a one-step revert available.
When to use
- An agent's ruleset edit breaks the audit run.
- You need to change a live policy threshold safely.
When not to use
- The ruleset is fine but verdicts are wrong (tune the rule logic).
- A human edited the ruleset directly (review the edit, same recovery applies).
Tool compatibility
- Version-controlled rulesets (JSON/YAML) in custom audit agents.
Variant phrasings
Ruleset corrupted by automated edit
Same failure, generic wording.
Policy patch broke audit rules
Names the patch as the cause.
Why it happens
Live rulesets are load-bearing configuration. An agent that patches them in place with no versioning, validation, or rollback turns a small edit into a total outage.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_2HzNhNsQohCsTQnL4uyDxg