Expand description
Traced first-deny-wins evaluation of the configured policy chain.
GovernanceEngine owns the instantiated chain: policies resolved from
the inventory registry against a GovernanceConfig, in declaration
order. GovernanceEngine::evaluate records a per-entry
ChainEntryOutcome — including disabled and skipped-after-deny entries —
so the audit row preserves the full evaluation order, not just the first
deny.
Policies that accumulate state (the rate limiter) scope it to their
instance, so two engines never share buckets — a second engine would
silently double every budget. GovernanceEngine::global is therefore the
way every enforcement point in a process reaches the chain: the MCP
governance webhook and the /v1/messages gateway must charge the same
limiter, not one each. GovernanceEngine::from_config remains available
for tests and for callers that genuinely want an isolated chain.
Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.
Structs§
- Evaluation
- The outcome of one traced chain run: the first-deny-wins
Decisionand the ordered per-entry trace destined for the audit row. - Governance
Engine