Checks agent-generated content against a provided policy corpus (NDAs, GDPR rules, company policies). Uses literal-string pattern matching — no regex, no ReDoS. The | operator splits a pattern into alternatives. Emits pass | flag | block, matched rules with excerpt context, risk level, and required remediation. Distinct from the constitution kernel (which gates actions before execution) — this kernel audits output content after generation.
Live demo — try a scenario
Sensitivity:
Content being audited
–
Active policies
–
–
–
–
What this kernel does: Scans content for literal-string matches against each policy rule's pattern. Severity determines whether the rule fires under the chosen sensitivity (permissive = critical only; standard = warning+critical; strict = all). A critical match → block; warning-only → flag; no match → pass. What it does NOT do: Does NOT use regex (ReDoS risk eliminated). Does NOT "know" the law — you provide the policy corpus. Does NOT redact content or suppress the output — your workflow decides what to do with the verdict. EcoCloud provides the evidence; the operator acts.
Source: flowdesk-policycheck-kernel.js · All 42 kernels →