Policy AVAILABLE
Deterministic rules that decide what may happen now.
What it is
- A versioned JSON document of rules over action, resource, agent, amount, time and delegation depth. Three effects: ALLOW, DENY, REQUIRE_APPROVAL.
Why it exists
- A permit is issued once and lives for weeks. Circumstances change daily. Policy is the layer that can say “not this week” without reissuing every permit in the organization.
How it works
- Save a version. Saving does not activate it.
- Simulate against it — no counter spent, no audit event written, nothing authorized.
- Activate it. That is the moment it starts deciding, and it is audited either way.
Who uses it
- Risk and compliance teams
- Platform engineers
- Anybody who has to explain a refusal
Security boundary
- A policy can never widen a permit. The final authority is the meet.
- Publishing and activating are POLICY_AUTHOR. ADMIN does not acquire them by being ADMIN.
- Evaluation is deterministic and reports which rules matched. Nothing here is a model output.
Example flow
Raising the bar without reissuing anything
- Version 3 allows procurement under 5,000 ₺.
- A quarter-end freeze arrives. Version 4 requires approval above 1,000 ₺.
- Simulate a typical request against version 4 first, and read which rules matched.
- Activate. Every permit in the organization is unchanged, and the bar moved.
Current status
| Capability | Status | Where |
|---|---|---|
| Read the active policy and its versions Reading the active version and the history. Publishing and activating are POLICY_AUTHOR. | READ ONLY | /projects/:id/policies |
| Publish a policy version | AVAILABLE | /projects/:id/policies |
| Simulate a decision against the policy | AVAILABLE | /projects/:id/policies |
| Activate a policy version | AVAILABLE | /projects/:id/policies |
Related API
PUT /v1/projects/:id/policyPOST /v1/projects/:id/policy/simulatePOST /v1/projects/:id/policy/activate