First Policy Evaluation

Evaluate an action against workspace policies before it executes.

POST /policy/evaluate checks the action context against all enabled policies in your workspace. The response tells you whether the action is allowed, blocked, or requires approval.

Request

bash

curl -X POST https://app.korclaw.com/api/v1/policy/evaluate \
  -H "Authorization: Bearer kc_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "input": {
      "action": "export",
      "resource": "customer-pii.csv",
      "agent": "data-agent",
      "environment": "production"
    }
  }'

Response

json

{
  "data": {
    "allowed": false,
    "action": "block",
    "matched": true,
    "policy": "Block PII Export",
    "severity": "high",
    "message": "PII exports are blocked in production.",
    "result": "blocked",
    "approval_id": null,
    "execution_proxy_required": false
  }
}

Input fields

Field	Description
action	The action being attempted (e.g. read_file, deploy, export)
resource	Target resource (file path, URL, database table)
tool / tool_name	MCP tool or external tool name
agent / agent_id / agent_slug / agent_name	Agent identity — at least one may be required by workspace settings
environment / agent_environment	Agent environment (production, staging, development)
endpoint	HTTP endpoint for API guard policies
user	Human actor initiating the action
approval_id	Replay an approved approval (valid for 15 minutes after decision)

Blocked and approval_required results return HTTP 200. Only infrastructure errors (auth, validation, audit failure) return error status codes.