Evaluation order
The order policy conditions are checked and where evaluation stops on the first match.
Evaluation stops at the first matching condition:
Agent ID
if permitted_agent_ids is set on the policy: deny if agent_id is absent; deny if agent_id does not match any pattern in the list.
Denied sources
if source_id is in denied_sources, immediately deny.
Denied tasks
if task_type is in denied_tasks, deny.
Allowed tasks
if allowed_tasks is non-empty and task_type is not in it, deny.
Allowed sources
if allowed_sources is non-empty and source_id is not in it, deny.
Sensitivity ceiling
the effective ceiling is the more restrictive of max_sensitivity and any applicable sensitivity_decay rule for the session's current age. If sensitivity_level exceeds the effective ceiling, deny.
Allow
all checks passed.
Default deny
no policy found for this agent_role.
Note: task_type and agent_id are both optional in requests. Task-level and agent-ID checks are skipped when the corresponding request field and policy field are both absent.