Your customers said 'Yes.' Can your systems act on it?

A customer opts in to personalized offers. A member changes their preferences in an app. A retailer wants to activate its loyalty base for a media campaign. An acquired company brings millions of customer records into the business.

In each case, the company has data it wants to use, as well as some indication it’s allowed to use it. But the moment that data actually moves through the business, a harder question emerges:

Can I use this data, right now, for this purpose?

That question used to get asked a few times a day, by a person, with time to think about it. Now it gets asked constantly, by agents, models, and systems that don't wait around for someone to weigh in.

Across the companies running Transcend as their policy-as-code infrastructure, data decision checks like these have already crossed 174 billion.

Policy Engine is the control layer that answers the question “Can I use this data?” quickly, accurately, and with the context of your business and data stack. It combines three key sets of rules into one decision: Business Policy, Regulatory Context, and Customer Permissions.

Data decision requests are checked the same way, every time, when your system or agent needs an answer. Here's what that looks like in practice.

AI agents that don't know what they're not allowed to use

Personalization, loyalty, and retargeting agents all ask a version of the same question hundreds of times a second: can I use this record? Most agents were built to move fast, so consent gets checked once, upstream, and never again once the agent is live.

A customer opts out on the website. The personalization agent never hears about it, and neither does the retargeting agent still refreshing its audience. With Policy Engine, every agent calls the same real-time decision before it acts, so the most current preference reaches all of them at once.

Permissioned data is ad inventory, if you can prove it's clear

Retailers building a retail media network, and brands feeding data into identity resolution through a partner like LiveRamp, hit the same bottleneck. The data exists.

What's missing is a fast way to prove which records are cleared for which use, so campaigns start with a manual pull and a legal review that eats the media window. With Policy Engine, every placement and every match checks a real-time decision built from actual consent and data-sharing terms.

One member, one set of preferences, every channel

A loyalty program spanning web, app, kiosk, and call center only works if a member's preferences look the same everywhere. Today, a member updates their settings in the app, and the kiosk keeps working from the old version until someone reconciles it by hand, usually after a complaint.

With Policy Engine, every channel and device checks the same real-time decision before it personalizes anything, so a change at the kiosk reaches the call center instantly.

A loyal customer of one brand, reachable by the family

Parent companies with multiple consumer brands hit the same wall: a customer who already said yes to one brand looks like a cold prospect to a sister brand, because each brand keeps its own consent record. At small scale that's an annoyance.

At enterprise scale, a media company managing thousands of creators, each with their own site and its own opt-out rules, it becomes unmanageable enough that marketing suppresses entire datasets rather than risk getting even one wrong.

Policy Engine lets a company set cross-brand inheritance once: opt-in with this brand carries to these others, under these conditions, unless the customer has since moved somewhere with stricter rules.

Reaching acquired customers without a multi-quarter migration

The standard M&A playbook maps the acquired company's schema and rebuilds its opt-out logic inside the parent's systems before anyone can market to those customers.

A health system acquiring a regional provider with 8,000 patients has paid for an audience it can't touch until that work finishes. With Policy Engine, the acquired data stays where it is, and the parent's rules apply to it immediately.

Old consent doesn't expire on its own

Most systems check whether a consent record exists, not how old it is, so a 5-year-old opt-in and a 5-week-old one count the same. When a company decides that's not good enough, the usual fix means rebuilding the check by hand in every downstream tool.

Policy Engine makes expiry a configurable window set per consent type, checked the moment the decision is made, so a 30-day model and a 365-day model can both run correctly without separate engineering work.

Where this goes next

These are 6 of the patterns we're tracking, out of a much longer list. Next in this series: what changes when it's not a person asking for permission, but an agent deciding on its own what it's allowed to do. After that, we'll get specific by industry, starting consumer, healthcare, finance, and media.

In the meantime, the 7-question AI Data Maturity Assessment takes about five minutes and shows you where your own stack stands, and the 2026 State of Customer Data in the World of AI report has the research behind the trend above.

Or reach out and we'll walk through a live decision against your own policies.