Review policy reference

Policy format

A policy is a JSON object with the lists baseline_steps, steps and rules, and an optional list constraints.

Field	Meaning
`steps[].id`	The step’s name, 1 to 64 characters.
`steps[].type`	`advisory`, `mandatory` or `final`. A policy has exactly one `final` step.
`steps[].responsibility_id`	The active responsibility that does the review. `null` on the final step, and required on every other step. Two mandatory steps cannot share one.
`steps[].required_by_tier`	Optional. People needed on a mandatory step per risk tier, such as `{"HIGH": 2}`. A tier not listed needs 1.
`steps[].depends_on`	Optional. Steps that must be cleared first. A mandatory step it names is added with it.
`steps[].distinct_from`	Optional. Steps whose reviewers cannot also review this one. Mandatory steps only.
`baseline_steps`	Steps every intake gets. The final step always applies.
`rules[]`	`{id, when, add_steps, explain}`. When `when` holds, the steps are added. Rules only add steps.
`constraints[]`	`{id, type: "distinct_actors", steps: [...], explain}`. Within one revision, nobody can count on two of the listed mandatory or final steps.

The number of approvals on the final step comes from the approver count for the intake’s risk tier, not from the policy.

Rule conditions

Each rule has one when, written {fact, op, value}. There is no AND or OR. Values are matched exactly as written.

Fact	Operators	Value
`inherent_risk_tier`	`eq`, `in`	A tier, or a list of tiers for `in`.
`data_classes`	`contains`	A data class.
`policies`	`contains`	A policy id.
`declared_capabilities`	`has_key`	A key of the capabilities object.
`labels`	`has_key`, `eq`	A label key, or `key=value` for `eq`.
`kind`	`eq`, `in`	`new`, `change` or `adopted`.

Versions

A version is a draft, then validated, then published. A published version is superseded when a newer one is published. Versions publish in order. After a newer version is published, an older draft cannot be. Publishing checks the policy again against today’s active responsibilities.

API

All routes in this table are under /v1/review. Reads need audit:read.

Route	Does	Needs
`PUT` / `DELETE /responsibilities/{id}`	Create, rename or retire a responsibility	`review:configure`
`PUT` / `DELETE /responsibilities/{id}/members/{principal}`	Add or remove a member	`review:configure`
`PUT` / `DELETE /responsibilities/{id}/groups/{group}`	Bind or unbind a group	`review:configure`
`POST /responsibilities/{id}/delegations`	Delegate a seat	`sod:approve` and an interactive sign-in (`review:configure` to name another delegator)
`GET /responsibilities/{id}/delegations`	List delegations	`audit:read`
`DELETE /delegations/{id}`	Revoke a delegation	the delegator, the delegate, or `review:configure`
`POST /policies`	Create the next draft	`review:configure`
`POST /policies/{version}/validate`	Validate a draft	`review:configure`
`POST /policies/{version}/simulate`	Show the steps a sample intake would get	`review:configure`
`POST /policies/{version}/impact`	Preview the effect on open intakes	`review:configure` and `audit:read`
`POST /policies/{version}/publish`	Publish a validated version	`review:publish`, an interactive sign-in, and not the author

A reviewer clears a step with POST /v1/sod/approvals carrying the responsibility id, and adds a note with POST /v1/intakes/{id}/notes. Both need sod:approve and an interactive sign-in.

Get started

Journeys

Concepts

Guides

Reference

Review policy reference

Policy format

Rule conditions

Versions

API

​Policy format

​Rule conditions

​Versions

​API

Policy format

Rule conditions

Versions

API