Loading…
Execution pattern
Policy change review
Govern changes to the rules, not only actions under them.
What executes
Someone edits a policy, raises a threshold, or disables a rule.
What normally goes wrong
Every control has an edit button, and loosening one is the fastest way to make a blocked action succeed. If policy changes are not themselves governed, the gate can be removed by whoever it inconveniences — and the record will show the action was permitted.
The decision
The signals available at the moment of the action, and the rule that judges them.
Signals
- Which rule changed, and in which direction
- Whether the editor is subject to the rule
- Blast radius of the loosened threshold
- Prior overrides against the same rule
The gate
Require independent review for any change that loosens a control, and refuse changes made by someone the rule constrains.
ALLOW
The change lands with its review recorded alongside the version.
ESCALATE
A loosening change waits on someone independent of it.
BLOCK
The change does not land — for example self-approval of one's own limit.
Four stages left to right. Input signals — user or agent identity, context and data, tools and resources, spend and budget, policies, history and reputation, and environment — enter the Decionis Protocol. Inside, the protocol normalizes context and intent, evaluates policies and rules, runs a deterministic risk and policy engine, and explains the reason and evidence. It emits a verdict: ALLOW (authorized), ESCALATE (needs approval or more info), or BLOCK (high risk or out of policy). The verdict drives an enforcement action: allow, block, require approval, or throttle and limit. Every decision is recorded for audit, learning, and continuous improvement.
6 policies implement this pattern
Fork one and change the thresholds. Available today on 5 platforms.
Adobe Commerce Price-Drift Circuit Breaker
Catches a pricing feed or AI engine publishing a price far off the last-known-good value before shoppers see it.
adobe commerce
GitHub AI-Authored Change Restraint
An agent can author the change; a human still has to sign the deploy. Restrains AI-authored diffs that touch deploy, infra, or migration paths.
github
GitHub Branch-Protection Gate
Require review before a force push. Blocks history rewrites on protected branches and escalates protection-setting changes.
github
HIPAA-Grade Access Change Gate
Privileged-access and production-change controls for ServiceNow ITSM — proving every change followed the approved path.
servicenow
Salesforce Regulated-Account Action Gate
Holds account changes on regulated or restricted customers until the right reviewer signs the record.
salesforce
Slack Refund-Approval Dossier
Turns the refund approval that happens in a Slack thread into a signed verdict carrying the policy version and reviewer authority.
slack
Related concepts
This pattern is one answer to each of these.
What to do next
The same five steps for every pattern in the library.
- Simulate this recipe
Run the policy against a realistic action in the browser. Push it past what the rules allow and watch the verdict come back. No account.
- View the signed Decision Dossier
See exactly what was decided and why: the rule that fired, the evidence it read, the policy version in force, and an Ed25519 signature you can verify yourself.
- Deploy in shadow mode
Measure what the policy would have caught on your own traffic without touching the live path. Every recipe defaults to shadow, so the first deployment carries no execution risk.
- Connect a real workflow
Point the same policy at the system where the action actually originates — a checkout, an ERP posting, a Zap, an agent's tool call.
- Share the verified result
Publish the proof: a public verification link, an embeddable badge, a PR comment, or an anonymized shadow-mode finding. This is how the next person discovers Decionis.