Your Policy Manual Just Became Code. But Who Signed Off?

For 10 minutes, in a late-September demo, Kaushal Kurapati, the global vice president of products for AI agent platform at Oracle, played a hospital administrator. The issue he set out to solve sits at the heart of hospital administration: staffing.

In this case, the telemetry unit, a hospital ward for patients on heart monitors, was at 70% staff coverage. Its target was 95%.

Kurapati gave Oracle’s new Fusion Claw three ways to find the solution: borrow nurses from another unit, let staff work four days in a row instead of three, or pay overtime.

Claw tested all three in simulation. Longer streaks reached 93% and missed the target. Overtime reached 97% but cost more. Moving staff reached 99% for 5% more cost, with no overtime and no rules broken. Claw then applied that plan on its own. No one approved it, because the administrator had already given Claw the authority to act.

No one asked for 99%, either. Claw beat the target by four points with a plan that raised costs 5%, and two shifts were still open. The receipt says Claw acted within its authority but does not say whether a cheaper plan could have stopped at 95%.

For a CDO, the overshoot is a side note.

The bigger story sat at the bottom of the audit report, which Oracle calls an outcome receipt. There, Claw listed the document it had followed: the staffing rules that apply to this hospital system in California. Kurapati said Oracle converts documents like this into procedural rules written in JavaScript. Claw does not reread the policy each time it runs. It runs the code.

“It’s not interpreting the document in a different way, it’s doing it in a deterministic manner,” Kurapati said. “You can be sure that’s 100% consistent, 100% accurate.”

Deterministic means the same input always produces the same output. So consistent, yes. Accurate depends on the translation, and someone, or something, had to write it.

Any agent that follows company policy needs this step, the one that turns written rules into instructions a machine can obey. Oracle is already shipping it. The company announced Fusion Claw on Sept. 29, 2026, with 25 Claw-powered applications for finance, HR, supply chain and sales.

Whoever checks the translation controls what the agent does. So who in your company has that job?

The lobster left the tank

To see why Oracle built Fusion Claw this way, we need to start with the free, open-source agent it is named after.

OpenClaw (formerly Clawdbot) is an AI agent with a lobster mascot that went viral in late January. Then the lobster got out. By Jan. 31, Censys had counted 21,639 OpenClaw instances exposed to the open internet, up from about 1,000 a week earlier. SecurityScorecard later counted more than 40,000, including those that attackers could take over by running their own code. Attackers also planted malicious add-ons in its skills marketplace.

Vendors drew opposite lessons. Nvidia’s NemoClaw, launched at its GTC conference in March 2026, runs agents in a sandbox, a sealed-off computing environment. But it lets a parent agent create sub-agents for specific jobs. Oracle ruled that out.

“It’s not interpreting the document in a different way, it’s doing it in a deterministic manner.” — Kaushal Kurapati @ Oracle

Oracle Fusion Claw can call only the agents already registered in its application. It cannot directly call the APIs of the system of record, the core business system that holds a company’s official data. And its container, the temporary space where it runs, exists only for the length of one task. “It does not have unfettered access to anything else outside,” Kurapati said.

Agents created mid-task also break the audit trail, he added: “What came into being and went away — you don’t know what happened there.”

A fixed set of agents makes counting possible, which matters. In a Dataiku/Harris Poll of 600 CIOs, 82% said employees create agents faster than IT can govern them. But a locked cage only moves the risk to whatever tells the agent what to do. That’s where the compiled policy comes in.

Deterministic code, probabilistic plan

Fusion Claw does its work in two stages. First, a frontier model, one of the most advanced large language models, reads the goal and writes a plan. Oracle says Fusion Claw uses models from OpenAI and Google, and Kurapati said the team chose accuracy over cost for this step.

In the second stage, ordinary software carries out the plan, running the calculations and simulations without calling the model again. Fusion Claw also saves the approaches that worked and reuses them when a similar problem comes back.

So “deterministic” describes only half the system. The plan comes from a probabilistic model, one that can give different answers to the same question, and the receipt records which model wrote it. Change the model and the plan can change. But the compiled policy sits under both stages and stays fixed. That makes it the code that matters most.

Consider a hypothetical failure. Take the rule from Kurapati’s demo: no more than three days in a row. Suppose the hospital counts a 7 p.m.-to-7 a.m. night shift against both calendar days it touches, but the compiled rule counts each shift only on the day it starts. A nurse can then work what the hospital treats as a fourth straight day, and the code sees nothing wrong. It gives the same answer every time. The receipt reports that no rules were broken.

That is the policy compiler problem. A chatbot’s mistakes vary from one answer to the next. A compiled rule makes the same mistake on every run, and documents it.

The problem now belongs to the CDO. Deciding what a rule means in a specific business is a question of definitions, which is really data governance work. It is the same fight as agreeing on what “active customer” means to finance and to sales. The difference is that the losing definition now executes automatically.

CISOs have a stake in the outcomes too. If policy documents feed the compiler, a tampered or outdated document turns into rules the agent executes. Ask whether your policy library gets the same change control as your source code.

In our interview, Oracle did not say who reviews the generated code, whether customers can read and edit it, how it is tested, or what happens to saved approaches when a policy changes. Ask any vendor selling rule-bound agents those four questions first.

Will anyone read the receipt?

Oracle’s answer to oversight is the outcome receipt. It records who set the task, what authority applied, which policy documents and model were used, and what changed.

I asked Kurapati about rubber stamping, when managers approve agent work without reading it because there is too much of it. He said a readable receipt helps. Older audit trails, he added, were “buried deep in the logs somewhere and who’s going to go and look at those logs?”

Readability carries its own risk. In a Harvard Business School field experiment with 228 evaluators, people followed AI recommendations more often when the AI explained itself, but their decisions got no better. Recommendations without explanations did improve decisions. Europe’s AI Act requires high-risk AI systems to be designed so their human overseers stay aware of automation bias, the habit of trusting machine output too much.

“What came into being and went away — you don’t know what happened there.” — Kaushal Kurapati @ Oracle

A receipt can also report only what Fusion Claw knew. If the compiled rule was wrong, the receipt cites it faithfully. It records the decision but does not check it.

There is a timing gap as well. Kurapati said Fusion Claw pulls real-time data from the system of record and alerts a person reviewing a plan when that data changes. He did not say what Fusion Claw does in full-auto mode, when no one is reviewing.

The delegation map

That gap matters because full auto is a setting the customer chooses. Fusion Claw lets customers set the automation level for each process, from simple assistance to full auto. Deciding which process gets which level is up to them.

Two questions sort most cases:

• How cleanly does the policy turn into code? A cap on consecutive shifts is already a number. “Reasonable accommodation” is not, so any code written for it is a guess.
• How easily can you undo the action? Next week’s roster can change tomorrow. A wire transfer cannot.

Together, the two answers point to a level. Clear rules on actions you can easily reverse can run on full auto, with someone checking a sample of receipts each week. Clear rules on actions that are hard to reverse, such as payments, call for the agent to plan while a person approves the release. Unclear rules on reversible work should get recommendations only. Unclear rules on decisions you cannot reverse, such as layoffs or credit denials, stay with a human.

These levels can change. Rewrite an unclear policy as clear, tested rules, and the process can earn more autonomy. Every rule you verify gives the agent more room. Every rule you don’t verify is a guess running at full speed.

Before you flip the switch

Check the economics before you set any levels. Fusion Claw costs nothing extra, but it runs inside Fusion Agentic Applications, which require a separate purchase on top of a standard Fusion subscription.

Oracle has not published measured savings or results from production use. Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027 because of rising costs, unclear business value or weak risk controls. Four steps can help.

• Treat compiled policy like production code. Give each rule an owner, a version number and tests based on the edge cases your managers already argue about. The policy owner should sign off on the code, not just the PDF.
• Expire old memory. When a policy changes, approaches Claw saved under the old version should stop being reused.
• Watch the approvers. If people approve in two seconds and never reject anything, they are probably not reading.
• Ask what full auto does when data changes. Get the answer in writing before you switch it on.

Kurapati’s own advice was to start small and prove the return before scaling up. “You are really putting your reputation, your business” in the hands of the software that coordinates the agents, he said.

This year, Nvidia and Oracle both put their agents in cages. In Fusion Claw, the bars are JavaScript, compiled from your policy manual.

Find out who in your company has read it.

Image credit: iStockphoto/BrianAJackson