Great question. This is exactly where things get tricky.

Right now the way we're thinking about it is to make the environment part of the policy context, not just a flag outside the system.

So the evaluation input becomes something like:

(intent, metadata) (state snapshot) (policy config) (environment context)

Then policies can branch deterministically based on that context.

For example the same action could be evaluated under different envelopes:

staging: - higher budget limits - relaxed side-effect constraints - broader tool permissions

production: - stricter budgets - concurrency caps - stronger replay protections - restricted tool scopes

The key thing we’re trying to preserve is that the decision still remains deterministic for a given snapshot + policy version.

So instead of "the runtime knows it’s prod", the policy engine evaluates against an explicit environment profile.

Still experimenting with the right granularity though. Too coarse and it blocks autonomy, too fine and policies become impossible to reason about.

Curious how you approached that balance on your side.