How a runtime engine takes in legal constraint data

About this documentUpdated 2026-09-21ShowHide

Sean McDermott, Co-Founder and CEO, UnGovr

Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.

Every law named here links to its summary page on lexlint.org, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.

© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same licence. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.

Corpus figures as of 2026-09-21.

Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice at the foot says what that means.

Agent deployments are converging on a proxy between the agent and its models, tools and other agents, evaluating a policy per call. Every one of those engines can decide a request, and none of them knows what the law asks. What a legal constraint looks like as data, how much of the law a request path can do anything about, measured, how the engine learns whose law is in play, the four shapes an integration can take, and the ceiling on what any of it may claim.

1What this document is

Every other document in this section is addressed to a person deciding something. This one is addressed to the engine on the request path that has to enforce it: the proxy between an AGENT and its models, its tools and other agents, evaluating a policy per call. Agent deployments are converging on that shape. The clearest open-source example, read on 2026-09-21, is agentgateway, a Linux Foundation project that proxies MCP, agent-to-agent and model traffic and exposes every request to a policy written in an expression language, with authentication, rate limiting, guardrails and telemetry around it. The integration platforms are growing equivalents: MuleSoft's gateway shipped policies for MCP and agent-to-agent traffic in its current release, read the same day. Each can decide a request. None of them knows what the law asks.

This document is about the translation between the two. What a legal constraint looks like once it is data an engine can hold; how much of the law a request path can do anything about, measured line by line rather than asserted; how the engine learns whose law is in play, which is the hard half; the shapes an integration can take and how each one fails; and the ceiling on what any of it may claim. It reads the layers of What you must constrain and the record of What you must be able to show from the engine's side, and it depends on Where the parties are, and whose law that makes applicable for the predicate at its centre.

2What a constraint looks like as data

The LexLint corpus already holds the parts. An instrument's duties are recorded as requirement lines, one atomic statement each, and every line carries the party it is addressed to, the party whose position triggers scope, the territorial hook it reaches through, its jurisdiction and whether the instrument binds today. A separate classification, made for a study of what a gateway can enforce, adds a tier saying what a control on the request path can do about the line and the signals such a control would need. Here is one, read from the corpus as this page was built.

The line	Adopt and follow a copyright policy that respects TDM opt-outs
Instrument	AI Act, Article 53 (obligations for providers of general-purpose AI models), Regulation (EU) 2024/1689, Article 53 (source)
Jurisdiction	European Union
Addressed to	Operator (the party running the application)
Scope turns on	Counterparty, one of COUNTERPARTY
Territorial hook	Establishment of the operator; placing on the market; where the output is used
At a runtime control	Enforceable at a runtime control
Read on	2026-08-15

What a gateway needs on top is small and it is the gateway's to write: a predicate over its own variables and an action. For the line above, the predicate is that a call is a fetch and its destination host has published a machine-readable reservation; the action is to refuse the call and to log the verdict with the line's identifier beside it. The law supplies the duty, the party and the place. The engine supplies the test and the verb. Nothing in the corpus tells an engine how to write the test, and nothing should: which variable carries the destination is the engine's business, and it changes between products.

Two of the fields do the work the other documents in this section describe. The party whose position triggers scope is what makes the line conditional on a place, and section 4 is about how an engine learns that place. The tier is what makes the line worth loading at all, and section 3 is about how much of the law has one worth loading.

3What a request path can do about the law, measured

The classification reads every requirement line that states a duty and asks what a control at the operator's edge, one that sees every call the AGENT makes and nothing to its left, could do about it. Four answers are possible.

Two rules decide the close cases, and they are worth knowing because they are where a vendor's claim and the law part company. A duty conditioned on a per-person fact a token can carry (consent, an opt-out signal, an age assurance, a human approval) is enforceable where the conduct flows through the control. A duty conditioned on a legal determination (a lawful basis, necessity, a legitimate interest, proportionality) is out of path, because no token carries a determination. Consent-default with listed exceptions is the first kind; coequal lawful bases are the second.

On 2026-09-21 the classification had reached 2,412 requirement lines in force, of the 5,698 the corpus holds in force across its four topics with requirement lines. The rest have no verdict yet and sit outside every figure below; the coverage is stated so that the figures are read as a floor.

The pattern is sharp and it is the finding a gateway builder should start from. Scraping law is the gateway's home ground: access, circumvention, reservation and volume are all visible in the fetch. AI law is mostly detectable, because its disclosure and marking duties close in the interface the gateway never draws. The largest share of privacy and cybersecurity law never crosses the request path at all, and that share has to be staffed rather than engineered. Where the enforceable share of privacy law comes from is one shape, a per-person condition a token can carry, which is why section 4 matters more than any policy syntax. The same figures, by percentage, are on Global AI law: 8 common threads in its section on what a control on the request path can do.

A verdict that is not out of path names the variables it needs, from a list of seven: the destination host; an identity claim the calling harness carries; the URL, endpoint or recipient in the tool arguments; the payload; the rate or count of calls; the deployment's own configuration; and the control's own record. Those seven are the whole interface between the law and an engine, and section 5 says which of them the current engines expose at decision time.

4Whose law, and how the engine knows it

A gateway sees a connection, not a party. Where the parties are, and whose law that makes applicable sets out which party each body of law reaches through and what evidence of that party's location exists; this section is what the engine holds of that evidence at the moment it evaluates a call. The short version is that it can name two parties from the wire, as domains, and needs a declared claim for the rest.

So the jurisdiction predicate is not something the gateway computes from scratch on every call. The operator's establishment is configuration. The provider's and the counterparty's places come from a domain and a dataset. The principal's place arrives as a claim, and the best design makes it one: the reading is made once, at the edge where the real client IP address exists, and travels in the call as a claim the gateway reads like any other identity claim and records beside its verdict. A gateway at the origin that re-derives the principal's place from the peer IP address gets the point of presence, well-formed and wrong, which is the failure Jurisdiction in logs exists to name. And unknown stays a value the claim may carry, read against the declared set as a whole rather than against no place.

5What the engines expose today

Read on 2026-09-21 from each product's own documentation, and stated with that date because these products move monthly. A document that described a policy surface it had not checked would be the corpus defect this section exists to avoid, one layer up.

agentgateway. Policy is written in the Common Expression Language and compiled when the configuration loads. An authorization rule over MCP traffic can test the tool, prompt or resource name, the backend target and the claims of a validated token, and a tool a client may not call is filtered from the list it is shown. The documentation states that tool arguments are not available during authorization: they are populated after the call completes, for the access log. So a verdict that turns on the URL a tool is about to fetch, which is most of the enforceable scraping law in section 3, does not run in the authorization rule. It runs in one of two external paths the gateway offers: an external authorizer that is compatible with Envoy's external-authorization service, sees the request and returns a decision with metadata the policy language can then read, and an external processor for MCP calls that receives the method, the target and the request or response parameters as a structured payload and may pass, mutate or deny them. That processor fails closed by default, and the documentation says when to choose otherwise. Guardrails over model traffic add regular expressions, hosted moderation services and webhooks, and every verdict reaches an OpenTelemetry log.

MuleSoft Omni Gateway 1.14. Agent policies are inbound policies for MCP and agent-to-agent traffic. Access to tools, resources and prompts is controlled by an attribute-based policy written in the Cedar language over tiers, client IP addresses, headers and token claims, which requires an authentication policy in front of it and is not offered in the gateway's local mode. Beside it sit detection of personal data in requests and responses, token-based rate limits, hosted content guardrails and a policy development kit in which a custom policy is written in Rust and released through the platform's exchange.

Nothing structural is missing from either for a legal ruleset. What is missing is the same on both: no variable, claim or vocabulary names a duty, a regime or a party's place. A policy names identities, destinations and arguments. The jurisdiction claim of section 4 and the line identifier of section 2 are what an operator adds, and both fit in the claim and metadata fields the engines already carry.

6The shapes an integration can take

Four ways for the law to reach the engine, each with a different staleness and a different failure. They compose, and the last paragraph says how.

The composition that works is the one the four rows imply. Declare once, because the operator's own places and activities are the facts nothing on the wire supplies. Compile the declared set into a bundle, and refresh it from the export on a schedule that is shorter than the time between commencement dates. Keep decision-time calls for the domain question and cache their answers. And read the jurisdiction of the principal from the claim the edge made, never by asking a service in the middle of the request. A rule that fails open is a rule that does nothing, so every shape above states its failure in advance, and the engine's own default, where it has one, is closed.

What LexLint publishes for those shapes today, stated so that nobody builds on a field that is not there. The register file behind The sixteen themes, filled from law carries, per requirement line, the party whose position triggers scope, the territorial hook, the runtime tier and the classification state, under its own non-commercial licence. The corpus export at data.ungovr.org carries every instrument with its requirement lines, status and dates, and does not yet carry the tier or the party. The tools at mcp.lexlint.org answer the per-request questions, resolving a domain to a jurisdiction among them. The signals a verdict needs are recorded in the classification and are not yet in any published file.

7What it must not claim

A gateway that enforces the enforceable tier has applied a technical measure. It has not made anyone compliant, and a product that implied otherwise would be the one thing this section's whole posture refuses. The duty's own standard governs whether the duty is met; the control is evidence toward that, and only that. The out-of-path share in section 3 is not a residue to be engineered later; it is the part of the law that is about contracts, determinations, programmes and people, and it stays that way whatever the engine can do.

Three limits are structural. An intent element is not on the wire: malice, deception and knowledge are facts about people, and no predicate detects them. A claim is checked for presence and issuer, never for truth: the gateway knows that a consent claim was carried, not that consent was given. And the record the gateway keeps is itself evidence with duties of its own, the classes and the retention periods of What you must be able to show, and a verdict logged beside a person's identifier has made the log the problem it was meant to answer. A lint passes as "no basic issues found", never as "compliant", and an engine loaded from the same data should say no more than the lint does.

8What this document does not claim

It does not say that any product enforces any duty, or that a policy written from the corpus satisfies one. The product surfaces described in section 5 were read from each vendor's documentation on the date shown and will have moved. The figures in section 3 describe how much of a corpus of software law a request path can act on, not how much of any system's exposure it covers, and they are a floor while the classification is incomplete. Nothing here is legal advice.