DecionisDevelopers
Policy pack

DevOps & CI

Governance for CI/CD and infrastructure workflows — Terraform apply/destroy and release/on-chain deploys.

Key
devops
Version
devops-v1
Rules
5
Domain
DEVOPS
Every packHow a pack decides

Rules, in the order the evaluator tries them

Highest priority first. The first rule whose conditions all hold decides; with none, the decision is a REVIEW.

  1. Escalate destroy of production infrastructure

    priority 200

    escalate_infra_destroy · DEVOPS

    When
    • decision_type in ["github_infra_destroy", "infra-destroy"]
    Then

    ESCALATE → ESCALATE · urgent · SLA 120 min

    Destroys must never run unattended; route to an authorized operator.

  2. Reject near-certain-risk changes

    priority 180

    reject_extreme_risk_change · DEVOPS

    When
    • risk_score ≥ 0.95
    Then

    AUTO_REJECT → REJECT · urgent · SLA 60 min

    A near-certain risk signal blocks the change outright.

  3. Review production Terraform apply

    priority 150

    review_infra_apply · DEVOPS

    When
    • decision_type in ["github_infra_apply", "infra-apply"]
    Then

    REQUIRE_REVIEW → REVIEW · elevated · SLA 240 min

    Production infrastructure changes require accountable review.

  4. Review on-chain / release deploy

    priority 140

    review_release_deploy · DEVOPS

    When
    • decision_type in ["github_escrow_deploy", "escrow-deploy"]
    Then

    REQUIRE_REVIEW → REVIEW · elevated · SLA 240 min

    Irreversible deploys require review of program authority/keypair.

  5. Approve routine CI executions

    priority 10

    approve_routine_ci · DEVOPS

    When
    • decision_type exists
    Then

    AUTO_APPROVE → APPROVE · routine · SLA 30 min

    Routine CI/devops steps proceed automatically when no control fires.

Evaluate under it

Locally, with @decionis/mcp: the payload becomes the request's context, and its action the decision type. On the hosted protocol, once the bundle is stored for your organization, name vertical_pack, policy_version and require_exact_policy_version: true.

decionis_evaluate arguments

{ "policy_pack": "devops", "payload": { "action": "<decision type>" } }

In a hosted evaluate-decision request

"vertical_pack": "devops",
"policy_version": "devops-v1",
"require_exact_policy_version": true

Workflow keys that resolve to this pack: ci, devops, github_infra_apply, github_infra_destroy, github_escrow_deploy, infra-apply, infra-destroy, escrow-deploy.

What its rules read

decision_type, risk_score are fields of the request itself, not of its context. A value put only in the context is discarded, and the evaluator holds the decision as an ESCALATE rather than decide without it. @decionis/mcp puts the whole payload in the context, so a payload that carries risk_score is held.

  • decision_typerequest
  • risk_scorerequest

Signals it maps

  • change_risk_scoreci
  • blast_radiusinfra