Sandbox-to-Live Policy Enforcement Parity Automation: Blocked in Rehearsal, Waved Through at the Premiere

A rehearsal or sandbox environment is specifically valuable because nothing about the real world changes when something inside it is blocked — which makes it a natural, low-risk place to build and test a strict safety or compliance check for the first time. The trap is treating that rehearsal check as if it were protecting the real thing simply because it shares the same name and the same underlying rule. A check that runs correctly every single time inside a simulation says nothing about whether the equivalent live action — the one with actual consequences — ever asks the identical question, and a live path that was never wired to call the check will succeed silently and completely, producing no error, no warning, and no visible sign that anything was skipped.

Adding a strict policy check to a rehearsal environment is often the path of least resistance precisely because rehearsal is where mistakes are cheapest — nobody is harmed if a simulated step gets blocked, so a team can iterate on the rule freely. That reasonable starting point becomes a real gap the moment the live execution path is built separately, by a different piece of work, without an explicit step confirming it calls the identical check. From that point forward, the live path simply works — copy gets generated, campaigns get exported — and success produces no signal that anything is missing, because a check that was never called can't produce an error for not having been called. The gap only becomes visible by deliberately tracing whether the real, consequential action path invokes the same function the rehearsal path already relies on, which is a check nothing about a normally functioning product would prompt anyone to run.

This gap was found in the same internal audit that rewrote Axiom's proof-of-action mechanism and connected its safety scanner to the real AI conversation path (both covered on this pillar's companion pages), described directly in the audit's own account: "the gate existed only in the sandbox — the policy blocked the rehearsal and cleared the premiere." Axiom's Sandbox already ran a genuine policy check, `quickPolicyCheck`, against any `submit` step's text before allowing that simulated step to proceed, evaluating the copy against Meta, Google Ads, or Google Business Profile-specific rules depending on the declared platform. That check worked correctly and had for some time. The problem was scope: it was the only place in the entire product this check was ever called.

The real execution path lives in a different function entirely — the one that actually processes a `GENERATE_CAMPAIGN_DRAFT` action, producing a downloadable campaign structure with real ad copy, naming conventions, audiences, and creative suggestions, which is the exact content that eventually reaches a platform like Meta once someone acts on it. Before the fix, generating that draft for real never once asked whether its own copy would pass the identical rule the Sandbox already enforced for a rehearsed version of the same action. The fix adds a new function, `extrairCopyParaPolicy`, that pulls the actual campaign name and every creative's description and suggested copy out of a campaign-draft payload, and calls it before the real action is allowed to complete. If a violation is found — the check returns a `blocked` status — the action is refused with a specific message naming the risk score and the number of findings, and the block itself is written to the audit trail with those same details, so even a caught violation leaves a durable record.

A detail the historical commit message doesn't fully spell out, found only by reading the diff itself closely: the fix deliberately covers a SECOND action type as well, `EXPORT_CAMPAIGN_DRAFT`. Exporting a campaign draft as a PDF downloads the identical copy an earlier `GENERATE_CAMPAIGN_DRAFT` action in the same session already produced — meaning that if only the generate step had been wired to the policy check, exporting would have remained a completely unguarded route to the exact same unscreened content, a bypass in all but name. The fix's own code comment states the reasoning directly: checking only the generation step and clearing the export step would simply invert which of the two steps got the scrutiny, not actually close the gap.

The platform classification driving which specific rule set applies is read from the campaign's own declared platform field, matching against Meta, Google Ads, or Google Business Profile — but when a campaign's platform isn't clearly one of those, the check deliberately falls back to a fourth, "generic" classification carrying the broadest applicable rule set, rather than skipping the check or defaulting to the narrowest one. The reasoning, again stated directly in the fix's own comment: when genuinely uncertain which specific rules should apply, the safer default is to evaluate against more rules, not fewer. Confirmed directly against the current source: `extrairCopyParaPolicy` and its call into `quickPolicyCheck` remain in `useSession.ts` today, unchanged since the fix, and the Sandbox's own original `submit`-step check remains in place as well — both paths now judged by the identical function.

An agent drafts Meta ad copy that trips a policy rule — say, an unsupported health claim. Rehearsing that same draft inside the Sandbox correctly blocks the simulated submit step. Before this fix, actually generating or exporting that identical draft for real skipped the check entirely, and the same unscreened copy would have reached whoever downloaded it. After the fix, generating or exporting that draft for real is blocked by the identical rule, with the block logged and explained, before the copy ever leaves the product.

Ad copy that would be flagged during a rehearsal is now flagged with equal certainty the moment someone actually generates or exports it for real — the two paths are judged by the same function, so a rehearsal's "safe" verdict and the real action's outcome can no longer silently disagree. A blocked attempt also now leaves an auditable record naming the specific risk score and finding count, rather than existing only as a rehearsal-time result nobody could later point to.

This fix closes the specific rehearsal-versus-live gap for campaign-draft copy across the generate and export action types — it does not add new ad-policy detection rules beyond what `quickPolicyCheck` already evaluated for the Sandbox, and it does not extend this particular parity check to action types outside the two confirmed to share this exact underlying content. A team wanting broader policy coverage of every possible AI-generated output, not specifically campaign-draft copy, would need that evaluated and built as a separate, additional scope.

A safety check wired only into a rehearsal path protects exactly that path and nothing else — the moment a real, consequential action reaches an equivalent outcome through a different route, the rehearsal's correctness becomes irrelevant. Centriu Axiom's fix closes that gap deliberately and completely: the same function, the same rules, and — critically — every action type confirmed to carry the same underlying content, so a fix scoped to only one of two routes couldn't leave the other standing open.