Policy Evaluation
How KorClaw evaluates actions against workspace policies.
POST /policy/evaluate loads all enabled policies, filters by scope (agent, environment), matches rules against the input context, and returns the highest-precedence outcome.
Evaluation results
| result | allowed | Meaning |
|---|---|---|
| allowed | true | Action is permitted |
| blocked | false | Action is denied by policy |
| approval_required | false | Action requires human approval before proceeding |
Side effects
- Always writes an audit log entry
- May auto-create an approval request for require_approval rules
- Emits audit.created webhook
- Returns 503 audit_persist_failed if audit write fails after an allowed evaluation