Brex built its AI agent policy by watching what agents actually do, not by writing rules first