Skip to main content
Syndicate Code home
Download + Run

Product documentation

Policy gate before side effects

Inspectable evidence record

Claim ref: policy-outside-runtime | Status: partial | Verification method: manual

Source ref: product-repo:internal/policy/evaluator.go@663e9e35b615e163cd5ef478cd0470be495b8ba2 | Verified at: 2026-03-19

Verified by: controlplane | Reproducible: yes

Product version: 0.5.0

Verification procedure: Reviewed control-plane policy gate sequence and confirmed deny branch executes before tool invocation path.

Verification confidence: medium

Replay fidelity: approximate

Reproduction steps:

  1. Inspect sanitized policy evaluation trace captured from control-plane request lifecycle.
  2. Confirm deny policy decision occurs before tool execution step in trace sequence.
  3. Confirm denied action records no side-effect completion event.

Environment context:

Repo state: product-repo@redacted

Checkout command: git checkout <commit-from-proof-record>

  • Access to sanitized policy-evaluation trace

Artifact refs: approval-binding-evidence

Proof boundaries

What this proves

  • Policy evaluation occurs before tool execution in the traced code path
  • Deny decisions prevent tool execution completion

What this does not prove

  • All code paths enforce policy before execution (only the traced path verified)
  • Offline or degraded mode behavior
  • Subprocess spawn outside tool boundary enforcement

Assumptions

  • Trace represents typical production execution flow
  • No bypass paths exist in untraced code

Failure modes

  • Bypass path discovered in untraced code
  • Policy evaluation disabled in offline mode

Break this claim

Conditions

  • Tool executes after policy evaluation returns denied
  • Side effect occurs without prior policy evaluation
  • Offline mode disables policy gate

Required evidence

  • Policy trace showing denied action executing
  • Event log showing execution without prior policy decision

This record links policy enforcement semantics to an inspectable request lifecycle sequence.

Scope: This proof verifies that the policy gate code path exists and evaluates in the traced execution order. It does not verify that all execution paths are gated, that offline mode is gated, or that the traced path is representative of production behavior. replayFidelity: approximate means the reproduction steps rely on a redacted trace rather than a reproducible command — this is structural verification, not end-to-end behavioral proof. Production guarantees about policy enforcement require additional test coverage and audit scope beyond what this record provides.