Workflow and Policy Engine

Proposed · draft 0.1Illustrative examples

Concepts

A policy has a trigger (the operation it applies to), conditions (when it applies), required evidence, approvals, exceptions, an escalation path, enforcement integrations, and audit records of how it was evaluated.

Collect, evaluate, enforce

Step	What happens
Collect	Evidence is gathered from existing tools and linked to events. Nothing is decided.
Evaluate	The evidence is checked against the policy and an outcome is reported.
Enforce	An operation is stopped technically, by an integration with the system that performs it.

Evaluating is not enforcing. Techlog evaluating a policy does not stop anything unless an enforcement integration acts on the outcome.

Outcomes

Examples use the production-upgrade policy below.

Outcome	Meaning	Example
Compliant	Every requirement is met.	An approved rollback plan, verified tests, and the owner's approval are all present.
Missing evidence	Required evidence is absent or not yet in the required status.	The rollback plan is still a draft.
Approval required	Evidence is complete, but a required approval has not been given.	No service-owner approval yet.
Blocked by policy	The policy says the operation must not proceed as it stands.	Evidence is missing and `on_unmet` is `block`.

Example policy

{
  "schema_version": "0.1-draft",
  "id": "pol_prod_upgrade_requires_rollback_plan",
  "description": "A production upgrade needs a reviewed rollback plan and a service-owner approval.",
  "trigger": { "operation": "production.upgrade", "system": "promo-api" },
  "conditions": [{ "field": "subject.environment", "equals": "production" }],
  "requires": {
    "evidence": [
      { "kind": "rollback.plan", "status": "approved" },
      { "kind": "test.report", "status": "verified" }
    ],
    "approvals": [{ "role": "service-owner", "count": 1 }]
  },
  "on_unmet": "block",
  "exceptions": [{ "kind": "risk_acceptance", "approver_role": "engineering-director", "expires_after_days": 7 }],
  "escalation": { "after_minutes": 30, "to": "role:on-call-lead" },
  "enforcement": { "mode": "evaluate_only", "integration": "none" }
}

trigger: applies to a production.upgrade of promo-api.
conditions: only when the environment is production.
requires.evidence: an approved rollback plan and a verified test report.
requires.approvals: one approval from the service-owner role.
on_unmet: the outcome when a requirement is missing is block.
exceptions: a risk acceptance by an engineering director, expiring after seven days.
escalation: after 30 minutes, go to the on-call lead.
enforcement.mode: evaluate_only. Techlog reports the outcome; the deployment system decides what to do with it.

Exceptions and risk acceptance

A named role may accept a risk for a limited time. The acceptance is recorded as an event, with the approver, the reason, and an expiry, and it stops applying when it expires.

Escalation

If an outcome stays unresolved past the configured time, it is escalated to a role, so an approval request does not wait unseen.

Enforcement integrations

Proposed examples are a status check on a deployment pipeline and an admission gate. Each needs its own authorization and its own threat model, and none exists yet.

Audit records

Every evaluation is recorded with its inputs and its outcome, so it is possible to see later why an operation was allowed or held.