Deterministic evaluation with explicit DENY precedence, mandatory conditions check, and safe default-deny.
Provides explainable governance summaries via verified endpoint POST /api/v1/ai/chat. Never replaces deterministic rules.
Alerts SecOps via POST /v1/notifications on high-risk ESCALATE requests and policy approvals.
Granted only when an active policy explicitly permits the action, workflow, and data source, and ALL mandatory conditions (e.g. consent, tokenized PII) are satisfied.
Triggered by explicit DENY rules (which override all allow rules), missing conditions, or the safe default-deny rule for unknown or insufficiently authorized assets.
Triggered when high-risk operations (e.g., bulk exports, model training on restricted financial or healthcare assets) touch sensitive data, routing to SecOps.