Policy Modes

A policy converts riskScore into recommendedAction, then applies the selected mode and safety floors to produce action.

Modes#

| Mode | recommendedAction | Returned action | Use | | --- | --- | --- | --- | | hybrid | Threshold result | Enforced result | Production enforcement. | | advisory | Threshold result | Always allow | Visible evaluation without enforcement. | | shadow | Threshold result | Always allow | Background baseline collection. |

Advisory responses include POLICY_MODE_ADVISORY; shadow responses include POLICY_MODE_SHADOW. Neither mode blocks live traffic.

Thresholds#

Default hybrid thresholds are:

| Score | Recommendation | | --- | --- | | At or below allowMaxScore (30) | allow | | Above allowMaxScore through reviewMaxScore (75) | review | | Above reviewMaxScore | block |

allowMaxScore must be less than or equal to reviewMaxScore.

Safety floors#

• degradedMinAction sets the minimum action when a scoring dependency is unavailable.
• oneHopMinAction sets the minimum action when ONE_HOP_GUARD_TRIGGERED fires.

Allowed floor values are allow, review, and block. A floor can raise, but not weaken, the threshold result in enforcing mode. Unavailable subsystems are identified by reason codes.

Read the policy#

curl "$VERTEXY_API_BASE_URL/risk-engine/policy" \
  -H "Authorization: Bearer $VERTEXY_ACCESS_TOKEN"

Update the policy#

curl -X PUT "$VERTEXY_API_BASE_URL/risk-engine/policy" \
  -H "Authorization: Bearer $VERTEXY_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "hybrid",
    "allowMaxScore": 30,
    "reviewMaxScore": 70,
    "degradedMinAction": "review",
    "oneHopMinAction": "review",
    "globalThreatPenaltyOverride": 25
  }'

All fields are optional; send only changes. Updates are recorded in the audit log.

Policy fields#

| Field | Type and constraint | | --- | --- | | mode | hybrid, advisory, or shadow. | | allowMaxScore | Integer, 0–100. | | reviewMaxScore | Integer, 0–100 and not below allowMaxScore. | | degradedMinAction | allow, review, or block. | | oneHopMinAction | allow, review, or block. | | globalThreatPenaltyOverride | Integer, 0–100. |