Loading…
Policy pack
DevOps & CI
Governance for CI/CD and infrastructure workflows — Terraform apply/destroy and release/on-chain deploys.
- Key
- devops
- Version
- devops-v1
- Rules
- 5
- Domain
- DEVOPS
Rules, in the order the evaluator tries them
Highest priority first. The first rule whose conditions all hold decides; with none, the decision is a REVIEW.
Escalate destroy of production infrastructure
priority 200escalate_infra_destroy · DEVOPS
When- decision_type in ["github_infra_destroy", "infra-destroy"]
ThenESCALATE → ESCALATE · urgent · SLA 120 min
Destroys must never run unattended; route to an authorized operator.
Reject near-certain-risk changes
priority 180reject_extreme_risk_change · DEVOPS
When- risk_score ≥ 0.95
ThenAUTO_REJECT → REJECT · urgent · SLA 60 min
A near-certain risk signal blocks the change outright.
Review production Terraform apply
priority 150review_infra_apply · DEVOPS
When- decision_type in ["github_infra_apply", "infra-apply"]
ThenREQUIRE_REVIEW → REVIEW · elevated · SLA 240 min
Production infrastructure changes require accountable review.
Review on-chain / release deploy
priority 140review_release_deploy · DEVOPS
When- decision_type in ["github_escrow_deploy", "escrow-deploy"]
ThenREQUIRE_REVIEW → REVIEW · elevated · SLA 240 min
Irreversible deploys require review of program authority/keypair.
Approve routine CI executions
priority 10approve_routine_ci · DEVOPS
When- decision_type exists
ThenAUTO_APPROVE → APPROVE · routine · SLA 30 min
Routine CI/devops steps proceed automatically when no control fires.
Evaluate under it
Locally, with @decionis/mcp: the payload becomes the request's context, and its action the decision type. On the hosted protocol, once the bundle is stored for your organization, name vertical_pack, policy_version and require_exact_policy_version: true.
decionis_evaluate arguments
{ "policy_pack": "devops", "payload": { "action": "<decision type>" } }In a hosted evaluate-decision request
"vertical_pack": "devops",
"policy_version": "devops-v1",
"require_exact_policy_version": trueWorkflow keys that resolve to this pack: ci, devops, github_infra_apply, github_infra_destroy, github_escrow_deploy, infra-apply, infra-destroy, escrow-deploy.
What its rules read
decision_type, risk_score are fields of the request itself, not of its context. A value put only in the context is discarded, and the evaluator holds the decision as an ESCALATE rather than decide without it. @decionis/mcp puts the whole payload in the context, so a payload that carries risk_score is held.
- decision_typerequest
- risk_scorerequest
Signals it maps
- change_risk_scoreci
- blast_radiusinfra