## TL;DR

The agent edited the live ruleset and broke it. Restore the last known-good version, make future edits against a copy, validate the edited ruleset in dry-run before promoting it, and require the validation to pass before any edit goes live.

## Error

```text
agent broke the audit ruleset while patching a policy threshold
```

## Steps

1. Immediately restore the last known-good ruleset version from version control. Expected: auditing works again on the good rules.
2. Diff the broken version against the good one. Expected: the exact edit that broke it is visible.
3. Fix the edit in a copy: correct the threshold syntax or structure. Expected: a candidate ruleset that looks right.
4. Validate the candidate in dry-run against a labeled set of past expenses. Expected: verdicts match the expected outcomes.
5. Only then promote the candidate to live, keeping the good version tagged for instant rollback. Expected: the change is live with a one-step revert available.

## When to use

- An agent's ruleset edit breaks the audit run.
- You need to change a live policy threshold safely.

## When not to use

- The ruleset is fine but verdicts are wrong (tune the rule logic).
- A human edited the ruleset directly (review the edit, same recovery applies).

## Tool compatibility

- Version-controlled rulesets (JSON/YAML) in custom audit agents.

## Variant phrasings

### Ruleset corrupted by automated edit

Same failure, generic wording.

### Policy patch broke audit rules

Names the patch as the cause.

## Why it happens

Live rulesets are load-bearing configuration. An agent that patches them in place with no versioning, validation, or rollback turns a small edit into a total outage.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2HzNhNsQohCsTQnL4uyDxg