Concept
Policy
The rules and flag state that turn a request into a decision, identified by hash.
Definition
A policy bundle is a ruleset plus the flag state it runs under, with an id. Its hash is written into every receipt, so a receipt names exactly the rules that produced it, and replay can run them again. Edge flags are compiled into the signed bundle; the request path never calls a flag service.
Shape
interface PolicyBundle {
id: string;
flags: Record<string, unknown>;
ruleset: unknown;
}
// policy_bundle_hash = sha256(canonical({ id, ruleset, flags: flag_state_hash }))Invariants
| Invariant | Checked by |
|---|---|
| The same bundle and the same request give the same decision. | crates/ag47-core/tests/properties.rs: reference_is_deterministic |
| Tool entitlement, robots, throttle, decoy, tarpit, work-challenge and canary rules stay behind flags. | packages/engine/src/engine.test.ts: "tool entitlement, robots, throttle, decoy, tarpit, pow, and canary stay behind flags" |
Out of scope
- Policy advice. Silvector runs the policy you set; shadow mode shows what a new one would do before it enforces.