Policy evaluations

The v2.2 SDK contract uses the same policy meanings across .NET, Python, TypeScript, Java, Go, and Rust. Each request evaluates one lifecycle event.

The server produces the canonical bytes used for hashing and idempotency. Applications send the request fields; they do not calculate a competing canonical representation.

Endpoints

Preview requests run the same validation and evaluator without side effects. They do not create enforcement evidence, reviews, reservations, notifications, or session timeline events.

Keep each rule dimension separate

Each rule records four different facts:

The portal labels the three placements Monitor after activity, Before action, and Before and after activity. It labels after-activity responses Record, Notify, and Flag session.

Understand deployment state

Deployment mode belongs to the exact rule version. It does not add another verdict.

Deployment state appears only for an active session rule with a before-action path. Missing deployment evidence is Unknown. It is never inferred as Enforced.

An evaluation record shows its execution path, deployment applicability and state, proposed response, applied-effect flag, rule version, digests, correlation, latency, and failure state. Observation-only telemetry is not enforcement. Open the session decision link with its exact decisionId to review that evidence.

Request contract

Set contractVersion to 2.0. Supply a stable decisionCorrelationId of no more than 128 characters. Reuse it only when retrying the same request.

{
  "contractVersion": "2.0",
  "interventionPoint": "pre_tool_call",
  "sessionId": "session-42",
  "decisionCorrelationId": "payment-42-pre-tool",
  "invocationId": "payment-42",
  "snapshot": {
    "amount": 1250,
    "currency": "USD"
  },
  "annotations": {
    "workflow": "supplier-payment"
  }
}

The closed intervention-point set is:

• agent_startup
• input
• pre_model_call
• post_model_call
• pre_tool_call
• post_tool_call
• agent_delegation
• output
• agent_shutdown

Govern a call to another agent

Use agent_delegation before one agent calls, delegates to, or hands off to another agent. The SDKs send it when you pass a delegation to govern. The snapshot carries the request in snapshot.delegation:

{
  "callee_application_id": "3c1f8f0e-58c4-4b4e-9e1d-4f2d6a1b7c90",
  "requested_scope": ["read:orders", "refund:orders"],
  "requested_tools": ["issue_refund"],
  "caller_scope": ["read:orders"],
  "chain": ["intake-orchestrator"]
}

Name the callee with callee_application_id for a governed application or callee_agent_id for any other agent, not both. requested_scope and requested_tools are required, even when empty. Without them, or without a callee, the delegation is denied before any rule runs.

Rules read input.delegation. VeriProof adds the facts the application can’t supply:

A Transform narrows the delegation. The rule’s replacement lists what it permits under delegation.requested_scope and delegation.requested_tools, and the response keeps only requested entries the rule permits. The action input isn’t changed, and a Transform never adds scope.

VeriProof derives the tenant, application, environment, entitlement, and authenticated identity on the server. Provider identifiers support correlation. They do not grant access.

Resume with the original caller

Use the same application workload or delegated user identity that opened the paused action.

Application workloads resume with an application key bound to the same application. Delegated callers use Agent OAuth with the veriproof.policy.evaluate scope. Their user, authentication method, and client must match the original binding.

VeriProof checks the tenant, application, session, invocation, branch, and protected action. It verifies the approved review case, durable signed receipt, current policy, and reviewed facts.

Only an authorized person can record the approval. Workload credentials cannot make that decision.

Do not put a user ID or caller type in the policy request. VeriProof accepts these values only from validated server claims. Autonomous agents cannot submit decisions that require a person.

Verdicts

The response returns exactly one winning verdict and keeps every matched policy result visible.

A policy result can return two forms of explanation:

• reasonCode is a stable machine value for routing, tests, and audit queries.
• message is a concise explanation for a person or agent, such as “The request exceeds the approved limit.”

Display message when the rule provides it. Otherwise, use the runtime reason returned by VeriProof. Keep reasonCode, rule identity, version, and source details in technical evidence. Do not let an agent invent or rewrite the policy reason. A Rego rule supplies the message through its matched violations text, and deterministic failing tests must check the expected text.

For durable enforcement evidence, VeriProof records the rule’s approved response message when one is configured. It does not copy dynamic evaluator text into the audit event because that text can contain application data. When no approved response message exists, the event uses a safe result summary such as Policy evaluation denied the action.

Precedence is deny, escalate, transform, warn, then allow. Policy evaluation fails closed. Runtime errors return deny with a safe runtime_error code; applications cannot enable fail-open behavior.

Retry safely

VeriProof stores evaluation claims under the tenant, application, contract version, and decision correlation ID. A retry with the same canonical request hash returns the original response. A different request using the same key returns a conflict.

Use one stable correlation ID per lifecycle episode. Use a new ID when the protected action, branch, replacement, or policy context changes.

Provenance

Each fact provenance entry has an independent source and assurance:

• Sources: application, provider, or veriproof.
• Assurance: asserted, signed, or verified.

Caller data defaults to application and asserted. SDK observation does not increase trust. Only server or provider verification can assign signed or verified.