Business Rules

Example (`.loki/rules.md`)

- The cart total must never be negative.
- A user cannot apply the same coupon twice.
- Guests must never see /admin.

How evaluation works

Business rules are evaluated once at the end of the session (not after every individual step). AIBrain.evaluate_business_rules() sends .loki/rules.md to the configured AI model together with the collected session evidence: the final DOM snapshot (dom_snapshot), recorded attacker actions (actions_taken), unhandled crashes and console/network errors (crashes), and responsive layout anomalies (layout_issues).

For each rule, the AI returns a structured verdict with status (PASSED or VIOLATED, or ERROR if the AI call fails) and an observation citing specific evidence from the run.

Enabling or skipping evaluation

Rule evaluation is enabled by default on loki run whenever .loki/rules.md exists. Use --rules / --no-rules (-r / -nr) to toggle it explicitly:

loki run http://localhost:3000 --rules      # default: evaluate .loki/rules.md at session end
loki run http://localhost:3000 --no-rules   # skip AI business rules evaluation