Decision boundary
Vertex AI is the distribution surface. Decionis Protocol remains the execution-time decision authority. The adapter route does request normalization and response shaping only.
Loading…
API documentation
Vertex AI extension quickstart
Use Decionis as a governed verification tool inside Vertex AI workflows without moving decision logic into the model layer. The current adapter route normalizes agent intent, invokes Decionis Protocol, and returns a governed verdict plus Decision Dossier proof that downstream tools can verify before write actions proceed.
Overview
This page documents the shareable phase 1 import path for Google Cloud and Vertex AI partners.
Current auth posture
The adapter always uses a Decionis org API key. It can now also verify an optional or required Google identity token at the adapter edge, which is the bridge toward Workload Identity Federation without moving policy logic into Vertex.
Use the adapter, not raw policy logic in Vertex
The OpenAPI artifact is intentionally thin. It describes a governed verification tool, not a second policy runtime. Keep policy versions, approvals, dossiers, and verification evidence inside Decionis surfaces.
Spec URL
This is the immediate shareable path for partner engineering teams.
OpenAPI artifact
Download or mirror this spec into a Google Cloud-controlled location if your import process prefers GCS-hosted artifacts.
https://decionis.com/openapi/decionis-vertex-extension-v1.yamlCompanion references
Use the API and Decision Dossier pages alongside the spec when a partner needs the adjacent contract details.
| Need | Path |
|---|---|
| API overview | /docs/api |
| Auth posture | /docs/auth |
| Decision Dossier verification | /docs/decision-dossier |
| Generic quickstart | /docs/quickstart |
Verify route
This route is the live Vertex adapter for governed verification requests.
POST
/v1/google-cloud/vertex/extensions/verifyAPI keyNormalize agent intent and Google context, invoke Decionis Protocol, and return a governed verdict with Decision Dossier verification links.
| Field | Meaning |
|---|---|
| org_id | Target Decionis workspace UUID. |
| decision_type | Decision family the workflow should evaluate. |
| workflow_key | Optional workflow template key when a governed pack is already selected. |
| system_of_record | Downstream system the agent intends to mutate. |
| intent | Action metadata and payload proposed by the agent. |
| google_context | Optional agent, session, project, and principal metadata captured at the adapter edge. |
Auth posture
Keep identity and authorization explicit at the adapter edge.
| Header | Required | Meaning |
|---|---|---|
| Authorization | Yes | Bearer org API key with decision:write, decision:*, or org:* scope. |
| x-google-identity-token | Optional or required by deployment | Google identity token used for adapter-edge identity proof. Enable or require it with the GOOGLE_CLOUD_VERTEX_OIDC_* env settings. |
| Idempotency-Key | Optional | Safe replay protection for tool retries or repeated agent calls. |
Response debug fields
The adapter response always includes google_identity_verified, google_identity_mode, and metering so partner teams can see whether Google identity proof was active and which billable decision unit the request produced.
Import flow
Keep the import sequence simple and explicit for a first partner run.
# 1. Download the Decionis OpenAPI artifact
curl -O https://decionis.com/openapi/decionis-vertex-extension-v1.yaml
# 2. Register or mirror the spec in the Google Cloud environment your import flow expects
# Example: upload the file to your controlled GCS location if your process requires it.
# 3. Configure the extension/tool to call the public Decionis adapter route:
# https://api.decionis.com/v1/google-cloud/vertex/extensions/verify
# 4. Supply a Decionis org API key
# Authorization: Bearer dcy_org_xxx
# 5. If your deployment enables Google adapter-edge verification, also send:
# x-google-identity-token: <google_oidc_token>
# 6. Use the response dossier links, google_identity flags, and metering fields to gate the downstream write actionExample call
This is the smallest useful request body for a first Vertex AI validation.
curl -X POST https://api.decionis.com/v1/google-cloud/vertex/extensions/verify \
-H "Authorization: Bearer dcy_org_xxx" \
-H "x-google-identity-token: <google_oidc_token>" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: vertex-verify-1" \
-d '{
"org_id": "c65f0510-bb59-48c7-9a73-f3b12338dfaa",
"decision_type": "TRANSACTION_ROUTING",
"workflow_key": "finance_transaction_routing",
"vertical_pack": "finance_transaction_routing",
"policy_version": "finance-routing-v2",
"system_of_record": "SAP",
"amount": 12500,
"risk_score": 0.18,
"intent": {
"action_type": "CREATE_VENDOR_PAYMENT",
"target_entity": "invoice",
"target_id": "INV-2048",
"payload": {
"invoice_id": "INV-2048",
"currency": "EUR"
}
},
"context": {
"region": "europe-west1",
"business_unit": "procurement"
},
"google_context": {
"agent_id": "vertex-agent-1",
"agent_session_id": "session-42",
"tool_call_id": "tool-call-7",
"project_id": "decionis-labs",
"location": "europe-west1",
"service_account_email": "vertex-agent@decionis-labs.iam.gserviceaccount.com"
}
}'Response posture
A successful response returns the governed status, the underlying Protocol outcome, the current policy version, the dossier identifiers, public verification URLs, Google identity verification state, the verified_decision metering envelope, and execution guidance such as EXECUTE, ESCALATE, BLOCK, or HOLD.
Operational posture
What is already implemented versus what remains enterprise hardening.
| Area | Status | Current posture |
|---|---|---|
| Google OIDC / WIF bridge | Available now | The adapter can validate a Google identity token from x-google-identity-token, enforce audiences, and mark the response as disabled, optional, or required. |
| Cloud Logging / Monitoring-friendly telemetry | Available now | Structured request logs include Google project, location, service account or subject, policy version, verdict, and metering labels so Google-native observability can ingest them cleanly. |
| Commercial metering seed | Available now | Each adapter response includes metering.unit=verified_decision and metering.count=1 so partner wrappers can connect that unit to downstream billing or service-control usage reporting. |
| Private Service Connect | Planned hardening | PSC remains the enterprise network posture for private deployments. It is intentionally separate from the decision contract and does not change Protocol authority. |
| Regional endpoints and CMEK | Planned hardening | Regional routing and CMEK/KMS guarantees belong in deployment topology and infrastructure controls, not in the Vertex adapter itself. |
Next hardening
These are the remaining enterprise follow-ons after the current adapter path is working.
| Next step | Why it matters |
|---|---|
| Google OIDC / Workload Identity Federation rollout | Moves more deployments from optional Google identity proof to a required adapter-edge trust posture. |
| Private Service Connect | Provides a private-network posture for regulated enterprise deployments. |
| Regional endpoints | Keeps verification traffic aligned to the customer’s regional control requirements without changing the decision boundary. |
| Service Control / enterprise metering | Connects the verified_decision unit to Google-native commercial reporting after the control-plane contract is stable. |
| CMEK-backed deployment posture | Adds customer-managed encryption guarantees where the customer’s deployment and region require them. |
| Observability export | Maps adapter and kernel telemetry into Cloud Logging and Cloud Monitoring without replacing the Decionis ledger or Decision Dossier proof model. |