What happens when Decionis cannot evaluate policy?

It depends on the surface, and each row below says what it does. Decionis's own surfaces are strict by default: the SDK, the API and the AgentSafe gateway do not let the action run without a decision. Some Commerce Gate connectors keep a sale moving during an outage instead, because a blocked shopper costs more than an unchecked order; their rows say so, and how an order that went ahead is marked. Shopify checkout keeps enforcing the signed policy snapshot already pushed to the store. Whatever the surface, failing to reach Decionis is never an authorization: no execution grant is issued without an evaluation.

Does fail-open ever override a rule that actually evaluated?

No. Continuity only applies when no evaluation could happen. If a rule ran and returned BLOCK, that verdict stands whatever the posture, and no execution grant is issued on a path where nothing was evaluated, so an outage cannot produce evidence of an approval.

Is a broken integration ever silent?

It should not be, and where it can be, its row says so. On Decionis's own surfaces, a rejected credential, a malformed response or a bug is treated as broken, not unavailable: POST /decide blocks it whatever the continuity setting. The API records a degraded event whenever its call to the decision engine fails. A failure that happens before a request reaches Decionis is visible only in the connector's own record, and each connector's row names that record or states the gap.

Trust Center

What happens when Decionis can't be reached

There is no single answer for every surface, and this page does not pretend there is. Each surface below states what it does with the action when it cannot get a decision, as the code does it today.

Failing to reach Decionis is never an authorization. No execution grant is issued without an evaluation, and an action that continues without one is ungoverned, never approved.

What reviewers ask first

What happens when Decionis cannot evaluate policy?: It depends on the surface, and each row below says what it does. Decionis's own surfaces are strict by default: the SDK, the API and the AgentSafe gateway do not let the action run without a decision. Some Commerce Gate connectors keep a sale moving during an outage instead, because a blocked shopper costs more than an unchecked order; their rows say so, and how an order that went ahead is marked. Shopify checkout keeps enforcing the signed policy snapshot already pushed to the store. Whatever the surface, failing to reach Decionis is never an authorization: no execution grant is issued without an evaluation.
Does fail-open ever override a rule that actually evaluated?: No. Continuity only applies when no evaluation could happen. If a rule ran and returned BLOCK, that verdict stands whatever the posture, and no execution grant is issued on a path where nothing was evaluated, so an outage cannot produce evidence of an approval.
Is a broken integration ever silent?: It should not be, and where it can be, its row says so. On Decionis's own surfaces, a rejected credential, a malformed response or a bug is treated as broken, not unavailable: POST /decide blocks it whatever the continuity setting. The API records a degraded event whenever its call to the decision engine fails. A failure that happens before a request reaches Decionis is visible only in the connector's own record, and each connector's row names that record or states the gap.

Three postures

Strict

If Decionis cannot be reached, the action does not run. It is refused or held until an evaluation can happen.

Suits: Payments and treasury releases; Privileged infrastructure changes; Machine-initiated actions with no natural limit on loss.

Bounded continuity

If Decionis cannot be reached, the action may continue without an evaluation. It is ungoverned, not approved, and it is available only where a surface was configured for it.

Suits: A shopper at checkout, where the exposure per order is small and bounded.

Custom

The institution sets the behaviour per rule or per signal, for example holding an action for review when one input is unavailable.

Suits: Institution-defined rules.

Some surfaces only observe: they record a verdict but have no way to hold the action. They are marked observe only, so nothing here implies they enforce.

Decionis surfaces

The SDK, the API, the AgentSafe gateway and the other surfaces Decionis ships.

@decionis/sdk enforceAndExecute

Strict

The action callback never runs: a timeout, invalid proof or an unreachable authority returns executed: false.

Checked against packages/sdk-node/src/ExecutionAuthority.ts

@decionis/sdk evaluateDecision, Express and Fastify gates

Strict

The call throws with no verdict, and the Express and Fastify gates stop before the route handler runs.

Checked against packages/sdk-node/src/Client.ts; src/Express.ts; src/Fastify.ts

@decionis/sdk inline agentic guard

Strict

The guard runs locally and blocks when its policy snapshot is missing, expired or unsigned.

Change it:: degradation_mode: "fail_open" on a request.
If it continues:: The result carries degraded: true and no execution grant.

Checked against packages/sdk-node/src/AgenticGate.ts

AgentSafe gateway

Strict

The request is refused with 503 and is not forwarded.

Change it:: --failure-policy failOpen (failurePolicy: FAIL_OPEN in the config).
If it continues:: The response carries agentsafe-execution: FORWARDED_UNGOVERNED, and the evidence chain records EXECUTION_UNGOVERNED.

Checked against decionis/agent-safe-pipeline: packages/agentsafe/src/gateway/Gateway.ts

POST /v1/decide

Strict

The action is blocked with 503 and not forwarded.

Change it:: fail_strategy: "allow" on a request, applied only to an outage; any other failed evaluation stays blocked.
If it continues:: verdict null, status FAIL_OPEN_UNGOVERNED, execution FORWARDED_UNGOVERNED.

Checked against apps/api/src/routes/DecisionLifecycleRoutes.ts

UCP checkout authorization

Strict

In enforcement the checkout is refused with 503 and no grant. In Shadow Mode the answer comes back before any evaluation and never holds the checkout.

Checked against apps/api/src/routes/UcpRoutes.ts

Agentic checkout authorization

Strict

The checkout is refused in every mode, with no grant.

Checked against apps/api/src/routes/AgenticRoutes.ts

Kubernetes admission webhook

Strict

In enforcement, admission is refused. In Shadow Mode, the default, requests are admitted and evaluated in the background.

Change it:: failureBehavior: FAIL_OPEN in the policy config or the Helm values.
If it continues:: An admission warning, and the decionis.com/decision: ERROR annotation.
Known gap:: With FAIL_OPEN set, requests are also admitted when the authority answers with an error, not only during an outage.

Checked against apps/kubernetes/src/admission/AdmissionDecisionService.ts; src/config/PolicyConfig.ts

Local agent hook (Claude Code, Codex, Cursor)

Strict

The tool call is denied on any gate error, local or remote.

Change it:: A repository with no DECIONIS_POLICY.md is not governed when the plugin passes --allow-ungoverned; a policy that exists but cannot be read still denies.
Known gap:: The host cannot tell a call allowed in an ungoverned repository from a governed allow.

Checked against apps/mcp/src/agent/LocalAgentGate.ts; apps/mcp/hooks/hooks.json

Azure API Management, enforce policy

Strict

Anything other than an explicit approve returns 503, and the request does not reach the backend.

Change it:: Swap in the shadow policy during rollout.

Checked against docs/marketplace/microsoft/azure-api-management/policies/decionis-gate-enforce.xml

Azure API Management, shadow policy

Observe only

Requests always reach the backend.

If it continues:: x-decionis-shadow-outcome: UNAVAILABLE on the response.

Checked against docs/marketplace/microsoft/azure-api-management/policies/decionis-gate-shadow.xml

@decionis/langchain

Strict

The wrapped tool does not run, including in shadow mode.

Checked against packages/langchain-decionis/src/DecionisGateTool.ts

Enterprise, automation and assistant connectors

Decionis Governed Execution Gate for SAP

Custom

If the Decionis gate cannot be reached, a local fallback gate decides with fixed rules (allow, block, delay or escalate), and a request missing required fields is blocked.

Change it:: Set DECIONIS_PROTOCOL_FAIL_CLOSED=1 to block instead.
If it continues:: The dossier is marked federated: false, with a local id.
Known gap:: The call to the Decionis gate has no timeout.

Checked against decionis/Commerce: apps/sap/srv/decionis-client.js; apps/sap/docs/runtime-config.md

Decionis Connector for ServiceNow

Strict

The governed Flow action stops and downstream updates are halted, in every mode. The shadow observers only record, after the record is saved.

Checked against apps/servicenow/app/script-includes/DecionisControlPlaneUtils.script.js; DecionisVerifyIntentAction.script.js

Decionis Action Gate for Salesforce

Custom

The action returns an error message and no decision. A Flow that requires continueAction to be true stops; a Flow that does not check it continues.

Change it:: Your Flow's condition on continueAction.
If it continues:: errorMessage is set and continueAction is empty.

Checked against docs/marketplace/salesforce/starter-package/force-app/main/default/classes/DecionisActionGate.cls

Decionis for Zapier

Strict

The step retries once, then Zapier replays it; later steps in the Zap do not run until Decionis answers.

Checked against packages/zapier-decionis/creates/DecisionDossierClient.js

Decionis for Make

Custom

Make connects through its HTTP module. Decionis answers 502, and your scenario's error handling decides whether the next module runs.

Change it:: The error handler on your scenario's HTTP module.

Checked against apps/web/app/docs/automation-connectors/page.tsx (Make recipe); apps/api/src/routes/ProtocolRoutes.ts

Decionis for n8n

Custom

n8n connects through its HTTP Request node. Decionis answers 502, and your workflow's error handling decides whether the next node runs.

Change it:: The HTTP Request node's On Error setting, and the IF branch on the outcome.

Checked against apps/web/app/docs/automation-connectors/page.tsx (n8n recipe); apps/api/src/routes/ProtocolRoutes.ts

ERP & Webhooks

Observe only

Webhooks carry signals in and decisions out; they never hold an action themselves. Senders should retry 5xx answers and timeouts with backoff.

Checked against apps/web/app/docs/webhooks/page.tsx

Decionis for Docker Desktop

Observe only

The extension shows decisions and verifies records offline; it does not hold container actions.

Checked against Registry scope (visibility and offline verification); extension source at github.com/decionis/docker

Decionis for Claude

Observe only

The connector never runs the action itself. If Decionis cannot answer, the tool returns an error and no authority card; what the assistant does next is up to the assistant and you.

If it continues:: The tool result is marked as an error.

Checked against apps/protocol/src/mcp/McpTools.ts

Decionis for ChatGPT

Observe only

The connector never runs the action itself. If Decionis cannot answer, the tool returns an error and no authority card; what the assistant does next is up to the assistant and you.

If it continues:: The tool result is marked as an error.

Checked against apps/protocol/src/mcp/McpTools.ts

AuthZEN input adapter (Node SDK)

Custom

AuthZEN feeds Decionis a signal; it is not a gate. If Decionis is down, the SDK call it feeds decides, strict by default. If your PDP is down, no signal is sent and your policy's rule for a missing signal applies; the starter policy holds the action for review.

Change it:: required_signals and on_failure in your policy, and the PDP timeout (five seconds by default).

Checked against packages/sdk-node/src/AuthZenEntitlementProvider.ts; docs/architecture/authzen-input-adapter.md

Commerce Gate connectors

Commerce Gate runs these connectors. Several keep a sale moving during an outage, where a blocked checkout would cost a present buyer more than an unchecked order. Each row says so, and how an order that went ahead is marked.

Decionis for Shopify

Strict

Checkout keeps enforcing the signed policy snapshot already pushed to the store, so an outage changes nothing until that snapshot expires after seven days. After that, or if the snapshot is missing, checkout is blocked.

Change it:: Each rule has an "If Decionis is unreachable" setting in the app, fail closed by default.
Known gap:: Only the net-margin rule's setting reaches checkout today; the other rules' settings are stored but not applied. A product with no cost on file is margin-checked as if its cost were zero.

Checked against decionis/Commerce: apps/shopify/extensions/*-hard-gate; app/lib/policies/RuleEnforcement.server.ts

Decionis for WooCommerce

Bounded continuity

If the store cannot reach Decionis, checkout continues by default.

Change it:: "If Decionis is unreachable" in the plugin settings: fail open (the default) or fail closed.
If it continues:: The order records the decision as bypassed, with the reason.
Known gap:: An error inside the gate is still answered as allow, so the order proceeds even when fail closed is set. An order with no cost on file proceeds without a margin check.

Checked against decionis/Commerce: connectors/woo/plugin/includes/checkout/RuntimeClient.php; includes/orders/DossierMetadata.php

Decionis for eBay

Bounded continuity

Listings are left as they are; the monitor never reprices or withdraws a listing without an answer.

If it continues:: The sweep result reports the listing as observed, with the enforcement error.

Checked against decionis/Commerce: connectors/adapters/ebay/src/enforcement/Enforcer.ts; connectors/ebay/src/Monitor.ts

Decionis Connector for Adobe Commerce

Bounded continuity

Checkout continues: the Magento hook is optional with a two-second timeout, and an engine error is answered as success.

If it continues:: Log lines at checkout; the post-placement sweep records orders it could not check.
Known gap:: A skipped checkout check is only logged, not stored as a decision record.

Checked against decionis/Commerce: connectors/adobe/magento-module/etc/webhooks.xml; connectors/adobe/src/App.ts

Decionis for Amazon

Observe only

Amazon has no way to hold an order, so Commerce Gate records decisions only. During an outage the order ships untouched.

If it continues:: The sweep is recorded as failed.

Checked against decionis/Commerce: connectors/amazon/src/orders/AmazonOrderGate.ts

Decionis Commerce Gate for Walmart Marketplace

Bounded continuity

Orders are acknowledged without a margin check. Refunds up to the fallback limit proceed, and larger refunds are held until the check is back.

Change it:: The refund fallback limit is set per deployment (1,000 by default); order acknowledgment behaviour is fixed.
If it continues:: Order Guard records the order as released without a margin check.
Known gap:: An engine fault is recorded with the same wording as a missing cost, and the refund record does not say the fallback limit was used.

Checked against decionis/Commerce: connectors/walmart/src/interception/OrderInterceptor.ts; src/policy/RefundPolicyGate.ts

Decionis for BigCommerce

Bounded continuity

An engine error is answered as allow and the order proceeds.

If it continues:: The response says bypassed; nothing is stored.
Known gap:: How the storefront handles a timeout is outside the connector repository and is not stated here.

Checked against decionis/Commerce: connectors/bigcommerce/src/App.ts