1.3 KiB
Policy governance runtime
WP-110 provides one deterministic evaluator for management simulation, the dataplane router, and first-party connector invocation adapters. Rules are parsed into typed selectors and evaluated in this order:
- missing binding is denied;
- terminal global denials are evaluated before any allow;
- explicit denials are evaluated;
- typed allows and their enumerated conditions are evaluated;
- the default is deny.
Rules contain selector values and bounded conditions only. They cannot execute scripts, perform regex evaluation, make outbound calls, or expand a project scope implicitly. A development selector matches only development; it does not imply production.
The Governance boundary carries the same InvocationContext into the rate limiter and append-only audit sink. A permitted call emits one success or error event; a denied or rate-limited call emits one corresponding event. The audit projection stores a SHA-256 argument hash, redacted bounded arguments, matched rule IDs, and a sanitized decision trace. Credentials and authorization headers are never included.
Connectors still perform their own project, environment, repository, document, and registered-container checks. Gateway policy is an additional boundary, not a substitute for connector authorization.