Documentation
¶
Overview ¶
Package policy loads declarative RiskKernel policy bundles from a riskkernel.yaml file — the "policy-as-code" form of the POST /v1/policies bundles, reviewable in PRs and applied on startup — and dry-runs a bundle against a recorded run so you can see what it WOULD have gated or halted before adopting it. All evaluation is deterministic; no LLM is consulted.
Index ¶
Constants ¶
const SchemaVersion = 1
SchemaVersion is the only riskkernel.yaml schema version understood today.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ApprovalPolicy ¶
type ApprovalPolicy struct {
RequireFor []Rule `yaml:"requireFor"`
}
type Bundle ¶
type Bundle struct {
Name string `yaml:"name"`
Budget Budget `yaml:"budget"`
ToolAllowlist []string `yaml:"toolAllowlist"`
ApprovalPolicy ApprovalPolicy `yaml:"approvalPolicy"`
}
Bundle mirrors the api/v1 Policy schema in YAML form.
type File ¶
File is a parsed riskkernel.yaml.
type Report ¶
type Report struct {
Policy string
RunID string
BudgetHalt string // "" if within budget, else the dimension that would have halted
BudgetDetail string
GatedCalls []storage.ToolCallRecord // would have required human approval
BlockedCalls []storage.ToolCallRecord // not in the tool allowlist
TotalCalls int
}
Report is the outcome of dry-running a bundle against a recorded run — what the bundle WOULD have done, changing nothing.
type RunData ¶
type RunData struct {
Run storage.RunRecord
Totals storage.LedgerTotals
ToolCalls []storage.ToolCallRecord
}
RunData is the recorded state of a run that a dry-run evaluates a bundle against.