Verdicts

interface PolicyDecision {
  verdict: "ALLOW" | "WARN" | "BLOCK" | "ESCALATE";
  stage: string;               // input | context_egress | output | delivery | action
  policyId: string;            // which latch fired, e.g. "latch-1"
  rule: string;                // human-readable rule name
  reason: string;              // why this verdict
  transformedContent?: string; // present on WARN rewrites (e.g. sensitive fields redacted)
  permitId?: string;           // present only on ALLOW + action
  mayContinue: boolean;        // ALLOW || WARN
}

function apply(decision: PolicyDecision, draft: string): Outcome {
  switch (decision.verdict) {
    case "ALLOW":
      return { deliver: draft };
    case "WARN":
      // The PDP rewrote the content; always prefer the transformed version.
      return { deliver: decision.transformedContent ?? draft };
    case "BLOCK":
      return { deliver: safeRefusal(decision.reason) };
    case "ESCALATE":
      queueForReviewer(decision);
      return { deliver: holdMessage() };
  }
}