Skip to content

PHASE_5.md

Latest commit

 

History

History
135 lines (115 loc) · 5.13 KB

PHASE_5.md

File metadata and controls

135 lines (115 loc) · 5.13 KB
Raw

Phase 5 deterministic policy example

Explanatory documentation only. This detailed walkthrough is non-normative and performs no Authorization, confirmation, Consumption, or Execution.

What problem does this example address?

The Host needs a deterministic, reviewable way to deny, require confirmation, or produce eligible allow evidence for one exact controlled input without letting model content define policy.

Why this flow?

Authenticated administration publishes a bounded immutable snapshot first. Evaluation then uses an exact policy ID and version, evaluates all applicable rules, and intersects scope contributions without callbacks or hidden state.

Minimal Swift walkthrough

This pseudo-code starts with three already validated Phase 4 inputs. It performs no model call, parsing, confirmation, authorization, execution, I/O, or persistence.

let transferInput: EvaluationInput = validatedTransferInput
let messageInput: EvaluationInput = validatedExternalMessageInput
let readInput: EvaluationInput = validatedReadInput
let hostCapabilityBoundary: HostCapabilityBoundary = retainedAuthenticatedHostBoundary

let transferScope = try PolicyScopeConstraint(
    capabilities: [.financialTransfer],
    resources: [ResourceID(rawValue: "account-42")]
)
let communicationScope = try PolicyScopeConstraint(
    capabilities: [.communicationExternal],
    resources: [ResourceID(rawValue: "recipient-7")]
)
let readScope = try PolicyScopeConstraint(
    capabilities: [.dataRead],
    resources: [ResourceID(rawValue: "report-2026")]
)

let transferDeny = try PolicyRule(
    id: PolicyRuleID(validating: "deny-unknown-transfer-influence"),
    condition: .all([
        .predicate(.sideEffectIs(.financial)),
        .predicate(.influenceBoundaryCompletenessIs(
            CollectionBoundaryID(validating: "proposal-collector"), .unknown
        )),
    ]),
    effect: .deny,
    reason: .influenceIncomplete
)
let messageConfirmation = try PolicyRule(
    id: PolicyRuleID(validating: "confirm-external-message"),
    condition: .predicate(.sideEffectIs(.externalCommunication)),
    effect: .requireConfirmation,
    reason: .confirmationRuleMatched,
    constraints: communicationScope,
    obligations: [.requireConfirmation, .requireAuditEvent]
)
let readAllow = try PolicyRule(
    id: PolicyRuleID(validating: "allow-verified-read"),
    condition: .all([
        .predicate(.sideEffectIs(.readOnly)),
        .predicate(.assuranceIsOneOf([.multiFactor, .phishingResistant])),
        .predicate(.provenanceTrustIsOneOf([.hostVerified])),
    ]),
    effect: .allow,
    reason: .allowRuleMatched,
    constraints: readScope,
    obligations: [.maximumEvaluationAgeSeconds(60)]
)

let policy = try PolicyDefinition(
    id: PolicyID(validating: "enterprise-default"),
    version: PolicyVersion(generation: 1),
    lifecycle: .active,
    rules: [transferDeny, messageConfirmation, readAllow]
)
var draft = PolicyDraft()
try draft.add(policy)
let snapshot = try draft.publishInitial(
    id: PolicySnapshotID(validating: "production-policy"),
    authority: policyAdministrationAuthority,
    capabilityBoundary: hostCapabilityBoundary
)
let exact = try snapshot.lookup(id: policy.id, version: policy.version)

let denied = try PolicyEvaluator.evaluate(
    decisionID: DecisionID(validating: "decision-transfer"), input: transferInput,
    snapshot: snapshot, hostCapabilityBoundary: hostCapabilityBoundary,
    policyID: exact.id, policyVersion: exact.version
)
let confirmation = try PolicyEvaluator.evaluate(
    decisionID: DecisionID(validating: "decision-message"), input: messageInput,
    snapshot: snapshot, hostCapabilityBoundary: hostCapabilityBoundary,
    policyID: exact.id, policyVersion: exact.version
)
let allowed = try PolicyEvaluator.evaluate(
    decisionID: DecisionID(validating: "decision-read"), input: readInput,
    snapshot: snapshot, hostCapabilityBoundary: hostCapabilityBoundary,
    policyID: exact.id, policyVersion: exact.version
)

// Reasons and obligations are stable. allowed.outcome == .allow is evidence only.
// It is not Authorization and nothing above executes a tool.

The Host must keep publication unreachable from model-controlled code. A later public transition may use the decision as input, but this example creates no Authorization or confirmation Challenge.

Threats prevented

  • Model-controlled or unpublished policy being treated as active policy.
  • Missing policy, no-match, or indeterminate evidence becoming allow.
  • Rule ordering changing deny and confirmation precedence.
  • Capability or resource scope being widened through union.
  • Silent latest-version policy substitution.

Common mistakes

  • Treating .allow as Authorization or permission to execute.
  • Publishing policy through a model-facing code path.
  • Omitting explicit scope constraints from non-deny rules.
  • Treating an empty constraint as a wildcard.
  • Adding dynamic callbacks, semantic classifiers, or ambient time to policy.

Related documentation