Decisions
Note
Guide: draft. The source build implements the current behavior below; remaining design work is marked explicitly.
A decision is the engine’s answer to an action request.
Values
| Value | Meaning |
|---|---|
allow | The action may proceed. |
deny | The action must not proceed. |
pending | The action must wait for an approver. |
Reason codes
Every decision carries a stable, machine-readable reason code, such as deny.policy or pending.opaque.
How decisions are reached
The engine runs five stages in order: identity, capability, policy, intent, and risk.
A deny from any stage wins.
When no rule matches, the decision is deny.
Grants
Only a policy rule, or a grant created by an approver, can produce allow.
A grant never overrides deny.