> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sengol.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Review policy reference

> The review policy format, the facts a rule can test, and the review workflow API.

Use this page with [Review workflows](https://docs.sengol.io/guides/review-workflows.md).

## Policy format

A policy is a JSON object with the lists `baseline_steps`, `steps` and
`rules`, and an optional list `constraints`.

| Field | Meaning |
| - | - |
| `steps[].id` | The step's name, 1 to 64 characters. |
| `steps[].type` | `advisory`, `mandatory` or `final`. A policy has exactly one `final` step. |
| `steps[].responsibility_id` | The active responsibility that does the review. `null` on the final step, and required on every other step. Two mandatory steps cannot share one. |
| `steps[].required_by_tier` | Optional. People needed on a mandatory step per risk tier, such as `{"HIGH": 2}`. A tier not listed needs 1. |
| `steps[].depends_on` | Optional. Steps that must be cleared first. A mandatory step it names is added with it. |
| `steps[].distinct_from` | Optional. Steps whose reviewers cannot also review this one. Mandatory steps only. |
| `baseline_steps` | Steps every intake gets. The final step always applies. |
| `rules[]` | `{id, when, add_steps, explain}`. When `when` holds, the steps are added. Rules only add steps. |
| `constraints[]` | `{id, type: "distinct_actors", steps: [...], explain}`. Within one revision, nobody can count on two of the listed mandatory or final steps. |

The number of approvals on the final step comes from the approver count for
the intake's risk tier, not from the policy.

## Rule conditions

Each rule has one `when`, written `{fact, op, value}`. There is no AND or OR.
Values are matched exactly as written.

| Fact | Operators | Value |
| - | - | - |
| `inherent_risk_tier` | `eq`, `in` | A tier, or a list of tiers for `in`. |
| `data_classes` | `contains` | A data class. |
| `policies` | `contains` | A policy id. |
| `declared_capabilities` | `has_key` | A key of the capabilities object. |
| `labels` | `has_key`, `eq` | A label key, or `key=value` for `eq`. |
| `kind` | `eq`, `in` | `new`, `change` or `adopted`. |

## Versions

A version is a draft, then validated, then published. A published version is
superseded when a newer one is published. Versions publish in order. After a
newer version is published, an older draft cannot be. Publishing checks the
policy again against today's active responsibilities.

## API

All routes in this table are under `/v1/review`. Reads need `audit:read`.

| Route | Does | Needs |
| - | - | - |
| `PUT` / `DELETE /responsibilities/{id}` | Create, rename or retire a responsibility | `review:configure` |
| `PUT` / `DELETE /responsibilities/{id}/members/{principal}` | Add or remove a member | `review:configure` |
| `PUT` / `DELETE /responsibilities/{id}/groups/{group}` | Bind or unbind a group | `review:configure` |
| `POST /responsibilities/{id}/delegations` | Delegate a seat | `sod:approve` and an interactive sign-in (`review:configure` to name another delegator) |
| `GET /responsibilities/{id}/delegations` | List delegations | `audit:read` |
| `DELETE /delegations/{id}` | Revoke a delegation | the delegator, the delegate, or `review:configure` |
| `POST /policies` | Create the next draft | `review:configure` |
| `POST /policies/{version}/validate` | Validate a draft | `review:configure` |
| `POST /policies/{version}/simulate` | Show the steps a sample intake would get | `review:configure` |
| `POST /policies/{version}/impact` | Preview the effect on open intakes | `review:configure` and `audit:read` |
| `POST /policies/{version}/publish` | Publish a validated version | `review:publish`, an interactive sign-in, and not the author |

A reviewer clears a step with `POST /v1/sod/approvals` carrying the
responsibility id, and adds a note with `POST /v1/intakes/{id}/notes`. Both
need `sod:approve` and an interactive sign-in.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.