Loading…
Shadow Mode
See what Decionis would have blocked — before you flip a single switch.
Same install everywhere we ship: GitHub Action, LangChain (Python & JS), Azure API Management, Slack, Shopify. The gate observes, records a signed Decision Dossier, and never changes caller behaviour — until you decide to enforce. One-line change to flip, reversible without uninstalling.
1
Pick the surface that touches your most-asked workflow
You don't have to wire every surface — start with the one whose audit you'd be asked about first. Tabs below swap the install snippet to that surface verbatim.
2
Install Azure API Management in shadow
Drop-in inbound policy fragment. Every gated operation echoes a dossier id + verify URL on its response headers.
xml
<!-- decionis-gate-shadow.xml — paste into an operation's inbound policy -->
<policies>
<inbound>
<base />
<!-- ignore-error="true": shadow rollout must NOT impact callers if Decionis is down -->
<send-request mode="new" response-variable-name="decionisResponse"
timeout="10" ignore-error="true">
<set-url>@("https://api.decionis.com/v1/protocol/evaluate-decision")</set-url>
<set-method>POST</set-method>
<set-header name="Authorization" exists-action="override">
<value>@("Bearer " + "{{decionis-api-key}}")</value>
</set-header>
<set-body>@{ /* canonical request from APIM context */ }</set-body>
</send-request>
<!-- … set x-decionis-dossier-id / x-decionis-shadow-outcome / x-decionis-mode: shadow … -->
</inbound>
<backend><base /></backend>
<outbound><base /></outbound>
<on-error><base /></on-error>
</policies>
3
Watch the would-have-blocked numbers
Every gated call produces a signed Decision Dossier. Nothing changes for callers.
Every response carries x-decionis-dossier-id + x-decionis-shadow-outcome headers. Aggregate the outcome distribution in your log pipeline (Azure Monitor / Log Analytics) before you flip.
- Per-dossierEvery call → one verifiable proof artifact at
/verify/decision-dossiers/<id>. - Per-weekVerdict distribution and a Decionis Score on /decionis-score — exportable as an executive PDF or AI-Act packet.
- Per-decisionForwardable Decision Dossier links — Slack / Teams / LinkedIn unfurl with the verdict OG card.
4
Flip Azure API Management to enforce
One-line change. Reversible without uninstalling.
diff
# Operation > Inbound processing > Code view
- <!-- decionis-gate-shadow.xml --> (mode=SHADOW, ignore-error=true, never blocks)
+ <!-- decionis-gate-enforce.xml --> (mode=ENFORCEMENT, fail-closed 503 on outage,
+ REJECT → 403, REVIEW/ESCALATE → 202)
Same dossier id, same verify URL, same audit log — the only difference is that blocked verdicts now actually hold the action. If a real workflow regresses, swap back to shadow: the rollback is the same one-line edit, in reverse.
Once you've been in shadow a few days
The numbers you collected become the case for enforcement.
Every dossier ID you record in shadow opens to a public verification page and unfurls with the OG verdict card in Slack / Teams / LinkedIn. Use them in the rollout review packet — the same signed artifact is the proof your CFO, your security reviewer, and your customer's auditor all want.