Signs the bundle hosted evaluation would run on right now and returns it as a compact JWS for the Decionis edge evaluator (the WebAssembly policy core a deployment runs inside its own network). The edge evaluator evaluates only bundles Decionis signed: it verifies the signature against the keys its release pins (published at /.well-known/decionis-policy-bundle-jwks.json), the audience against its organization, the validity window against the time its host supplies, and the bundle against bundle_digest.

Selection is hosted evaluation's own: the newest active bundle whose effective window contains now and that passes the maker-checker gate, or, when policy_version is given, exactly that version among them. An unapproved, historical, not-yet-effective or expired bundle is never signed; like hosted evaluation, it is treated as not active and the answer is 404 POLICY_BUNDLE_NOT_FOUND with the policy guard's reason.

The signed bundle lives ttl_seconds (default 7 days, at most 30 days and at most the organization's plan maximum), never past the bundle's own effective_to. Every issuance is recorded before it is returned (see GET /v1/edge/policy-bundles/issuances); one that cannot be recorded is not issued. Requires an organization API key with policy:read (or policy:* / org:*); keys without explicit scopes are refused.

Only organizations licensed for the edge evaluator receive bundles: Enterprise and self-managed plans include it, Premium with the edge add-on, and an operator may list an organization for a pilot. Any other organization is answered 403 EDGE_EVALUATOR_NOT_ENTITLED (its signed entitlement, GET /v1/edge/entitlement, says why).

The bundle is core_abi: 3: it also carries what hosted would decide differently for this organization, resolved with hosted's own code — vertical_pack (its configured pack, or the operator's pack override, else null) and max_mode / max_mode_reason (SHADOW with hosted's 403 code for an unclaimed provisional or AWS service workspace, else ENFORCEMENT). An edge module older than ABI 3 refuses such a bundle rather than decide without them.