Policy Engine Overview

The Policy Engine is the deterministic ruleset that turns pillar scores into enforcement decisions — versioned, testable, and safe to roll out.

What a policy is

A policy is a deterministic function: pillar scores + flags → verdict. It is defined by per-pillar weights and thresholds and is fully reproducible — the same inputs and policy version always yield the same decision.

Shadow vs active

Shadow (default)

The policy is evaluated and logged, but no enforcement action is taken. Use it to measure impact on real traffic with zero risk.

Active

The policy is enforced: BLOCK verdicts stop output, REVIEW routes to your fallback, and so on.

New policies start in shadow mode by default. Nothing you create can affect production traffic until you explicitly promote it.

Safe rollout

1

Create the policy and let it run in shadow against live traffic.

2

Review the would-be verdicts in the dashboard — check false-positive rate and blocked volume.

3

Tune weights and thresholds, then promote to active enforcement.

4

Roll back instantly to a prior version if needed.

Anatomy of a policy

  • Weights — how much each pillar contributes to the overall score.
  • Thresholds — the score bands that map to ALLOW/WARN/REVIEW/BLOCK.
  • Hard-block flags — flags that force BLOCK regardless of score.
  • Mode — shadow or active.
Was this page helpful?