Sapien is a stateful policy engine for autonomous AI agents that enforces contextual policies by specifying permitted tool-call sequences using regular expressions, stateful predicates, and deferred policy generation. It can rule out up to 95% of attacks on AgentDojo and 85% on Toolathlon, even if the agent is fully hijacked.