GEgetaxonflow
Dynamic Policies

Test policy evaluation

Test how dynamic policies evaluate a sample request

post/api/v1/policies/test

Request

Request body

querystring required
request_typestring

Response

Policy evaluation result

allowedboolean
applied_policiesstring[]
risk_scorenumber
severity'critical' | 'high' | 'medium' | 'low'

Highest severity among the matched policies.

severity_policy_idstring

The policy that contributed severity.

required_actionsstring[]
processing_time_msinteger
database_accessedboolean
evaluation_errorboolean

Distinguishes could not govern from a policy said block, and is the only signal that does. True when the engine could NOT complete evaluation because governance-segment resolution failed (a resolver or storage error -- never "the caller belongs to zero segments"). allowed is always false when this is set, because the engine fails CLOSED on that error, so a consumer reading only allowed still behaves safely; a consumer that audits or alerts MUST read this field to tell an availability failure apart from a genuine policy match. Before it existed the only signal was the magic string applied_policies: ["segment_resolution_failed"].

segments_resolvedboolean

True only when a resolved, non-empty governance-segment set was actually factored into this verdict. False covers every legitimate organisation-only case -- no identity supplied, no resolver wired (community, or no SCIM), or the caller belongs to zero segments -- as well as the evaluation_error case. None of those are failures: the flag exists so a reader of a policy-simulation preview does not mistake a legitimate org-only allow for a segment-aware one.

preferred_providerstring

LLM provider a matched routing policy prefers. When more than one applying route row names one, the LAST applying row in evaluation order wins it and the routing reason: rows are walked by priority, highest first, then newest first, so the winner is the lowest-priority applying row (#4249).

allowed_providersstring[]

Strict provider allow-list for compliance routing. Failover stays within this list. It is the intersection of every applying route row's list, whatever their order; an empty intersection refuses the request (no_compliant_provider).

routing_reasonstring

Why routing was changed.

Changes

No recorded changes to this operation across all 1 revision of this API.