AUTHORIZATION / MODULE REFERENCE

Policy

Evaluate explicit symbolic rules for actions. Language models propose; deterministic Policy decides.

Direct API: POST /api/v1/modules/policyManage API keys ↗View code boilerplate ↗

When to use it

Evaluate risk rules in your own backend logic layer before executing transactions or sensitive customer actions.

Supported Operations & Data Contracts

Call this module with a key scoped to 'policy'. Provide the operation name and matching input dictionary.

`evaluate` · Evaluate Symbolic Risk RulesPOST /api/v1/modules/policy

Executes deterministic business logic, trust thresholds, and fraud checks on supplied evidence and transaction parameters.

Input Parameters

Field	Type	Requirement	Description
`authenticity`	`'PASS' \| 'FAIL' \| 'UNCERTAIN'`	Required	Voice authenticity signal from Voiceprint or upstream detection.
`identity`	`'MATCH' \| 'NO_MATCH' \| 'UNCERTAIN'`	Required	Speaker biometric match confirmation.
`action`	`'balance' \| 'statement' \| 'transfer' \| 'faq' \| 'limits' \| 'unknown'`	Required	Target action to authorize.
`budget`	`number (0-100)`	Required	Current customer session trust budget points.
`stickyFail`	`boolean`	Required	Whether an earlier verification attempt failed during this session.
`shortAudio`	`boolean`	Required	Flag indicating whether speech input was too brief for confident verification.
`amount`	`number (integer)`	Optional	Required if action is 'transfer'. Transaction amount in minor units (e.g. 50000 = ₹500).
`demoTransferThreshold`	`number`	Optional	Threshold in minor units before requiring step-up authentication (default 100,000).

Output Fields

Field	Type	Description
`decision`	`'ALLOW' \| 'STEP_UP' \| 'HOLD' \| 'SPEAK_MORE'`	Deterministic policy evaluation verdict.
`ruleId`	`string`	Identifier of rule matched in policy pack (e.g. TRANSFER_OK, AUTHENTICITY_FAIL).
`explanation`	`string`	Detailed rationale explaining why this decision was rendered.
`budgetMovement`	`number`	Change in budget points resulting from this evaluation.
`cost`	`number`	Budget cost incurred by this action.
`advisory`	`boolean (true)`	Always true for standalone API calls. Does not issue an execution permit.

Example Request Payload

JSON Request BodyContent-Type: application/json

{
  "operation": "evaluate",
  "input": {
    "authenticity": "PASS",
    "identity": "MATCH",
    "action": "transfer",
    "amount": 25000,
    "budget": 100,
    "stickyFail": false,
    "shortAudio": false
  }
}

Example Response

JSON Response (HTTP 200)Cache-Control: no-store

{
  "module": "policy",
  "output": {
    "decision": "ALLOW",
    "ruleId": "TRANSFER_OK",
    "explanation": "Authenticity PASS, Identity MATCH, amount within policy thresholds.",
    "budgetMovement": -10,
    "cost": 10,
    "advisory": true
  }
}

Configuration in Graph Builder

When adding Policy into a visual component or graph workflow, configure its node runtime settings in the builder inspector:

Connect Voiceprint and Frontdoor into Policy. In Policy settings, configure bindings: 'authenticity' from Voiceprint 'status', and 'action' from Frontdoor 'toolRequest.action'. Add outgoing edge condition 'when: { path: ["decision"], equals: "ALLOW" }' to guard subsequent mutation nodes.

Direct API Code Examples

Invoke this module directly from your backend services without passing through the visual builder:

TypeScript / Node.js (Fetch)index.ts

const response = await fetch("https://api.sherlock.dev/api/v1/modules/policy", {
  method: "POST",
  headers: {
    "Authorization": "Bearer " + process.env.SHERLOCK_API_KEY,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    operation: "evaluate",
    input: {
      authenticity: "PASS",
      identity: "MATCH",
      action: "transfer",
      amount: 15000,
      budget: 100,
      stickyFail: false,
      shortAudio: false,
    }
  }),
});
const { output } = await response.json();
if (output.decision !== "ALLOW") {
  throw new Error("Action rejected: " + output.explanation);
}

cURL / Bashterminal

curl -X POST "$SHERLOCK_BASE_URL/api/v1/modules/policy" \
  -H "Authorization: Bearer $SHERLOCK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"operation":"evaluate","input":{"authenticity":"PASS","identity":"MATCH","action":"balance","budget":100,"stickyFail":false,"shortAudio":false}}'

Current Boundaries & Guarantees

Evaluates the active policy pack deterministically. Advisory evaluations never mint execution permits or grant customer permissions. Non-ALLOW results stop graph execution.

Related Trust Modules

Passport ↗Gate ↗Pulse ↗