Worked policies

Written for policy-engine v0.7.3, synced verbatim from docs/EXAMPLES.md in Repyh-Labs/policy-engine — do not edit this page, regenerate it. The policy engine overview says which Orchestrator release runs this compiler.

This document contains non-normative examples for the policy language defined in the language reference.

1. Simple Allowlist

name geo_guard

parameters {
  allowed_countries: Set<string>
}

requires {
  # Require the country to be one of the allowed countries.
  evidence.country in parameters.allowed_countries;
}

2. Date Window with Chained Comparison

name delivery_deadline_guard

requires {
  # Require delivery during calendar year 2026.
  date(2026-01-01) <= evidence.delivery <= date(2026-12-31);
}

At runtime, evidence.delivery must be a date; otherwise the constraint hits a runtime error.

3. Optional Fields

name tshirt_guard

parameters {
  # At runtime, this field might be missing.
  color: optional Set<string>
}

requires {
  # If the user specified colors, require the shirt color to be allowed.
  optional: evidence.color in parameters.color;
}

Rejected at compile time: a non-optional: constraint references the optional parameter color.

requires {
  evidence.color in parameters.color;
}

Rejected at compile time: an optional: constraint does not reference any optional parameter.

requires {
  optional: evidence.material == "cotton";
}

4. String List

name tag_guard

parameters {
  allowed_tags: Set<string>
}

requires {
  # Require every tag to be allowed.
  all(tag in parameters.allowed_tags for tag in evidence.tags);

  # Require at least one tag.
  count(evidence.tags) >= 1;
}

4.1 List Length and Indexing

name reading_guard

parameters {
  max_readings: int
}

requires {
  # Bound the number of readings.
  count(evidence.readings) <= parameters.max_readings;

  # The first reading must be within range.
  0 <= evidence.readings.0 <= 100;
}

At runtime, evidence.readings must be a List<int>; an empty list makes evidence.readings.0 a runtime error.

4.2 Digit-Leading Field Names

Field names may start with a digit, as happens when an evidence producer mechanically snake_cases attribute names.

name psu_guard

requires {
  # "80 Plus efficiency rating" snake_cased by the evidence producer.
  evidence.80_plus_efficiency_rating in {"Gold", "Platinum", "Titanium"};
}

5. Cart with Object Fields

Object attributes such as unit_price_usd_cents and supplier are typed by the evidence schema supplied at compile time.

name procurement_guard

parameters {
  max_total_usd_cents: int
  allowed_suppliers: Set<string>
}

requires {
  # Require the cart total, including shipping, to stay within budget.
  sum(item.unit_price_usd_cents * item.quantity for item in evidence.cart)
    + evidence.shipping_usd_cents <= parameters.max_total_usd_cents;

  # Require every item supplier to be allowed.
  all(item.supplier in parameters.allowed_suppliers for item in evidence.cart);
}

With parameters {"max_total_usd_cents": {"int": 5000}, "allowed_suppliers": {"Set<string>": ["acme", "globex"]}}:

Accepted:

{
  "cart": { "List<Object>": [
    {
      "unit_price_usd_cents": { "int": 1200 },
      "quantity": { "int": 2 },
      "supplier": { "string": "acme" }
    },
    {
      "unit_price_usd_cents": { "int": 900 },
      "quantity": { "int": 1 },
      "supplier": { "string": "globex" }
    }
  ] },
  "shipping_usd_cents": { "int": 500 }
}

Rejected with runtime error: multiplying item price by quantity overflows.

{
  "cart": { "List<Object>": [
    {
      "unit_price_usd_cents": { "int": 9223372036854775807 },
      "quantity": { "int": 2 },
      "supplier": { "string": "acme" }
    }
  ] },
  "shipping_usd_cents": { "int": 0 }
}

6. Cart with Tree Fields

name supermarket_guard

requires {
  # Require at least one food item.
  count(item for item in evidence.cart
        if item.category under "Food") >= 1;

  # Require every vegetable item to be organic.
  all(item.organic for item in evidence.cart
      if item.category under "Food > Vegetables");
}

Compiled with an evidence schema whose cart items are a tree keyed by category, containing the node Food > Vegetables with the field organic: bool, the accesses item.category and item.organic and the category literals are checked ahead of runtime.

This filter narrows item to Food, the deepest common ancestor of the two paths:

all(item.perishable for item in evidence.cart
    if item.category in {"Food > Vegetables", "Food > Fruit"});

Rejected when compiling: Food > Vegtables is not a declared tree node.

any(item.category in {"Food > Vegtables"} for item in evidence.cart);

If the evidence schema declared brand as a common string field, then item.brand in {"Food > Vegtables"} would remain ordinary Set<string> membership and would not be category-checked.

Accepted: non-vegetable items do not need organic.

{
  "cart": { "List<Object>": [
    {
      "category": { "string": "Food > Vegetables" },
      "price_usd_cents": { "int": 250 },
      "quantity": { "int": 2 },
      "organic": { "bool": true }
    },
    {
      "category": { "string": "Apparel > Shoes" },
      "price_usd_cents": { "int": 5000 },
      "quantity": { "int": 1 }
    }
  ] }
}

Rejected with runtime error: count reads the missing category field.

{
  "cart": { "List<Object>": [
    {
      "price_usd_cents": { "int": 5000 },
      "quantity": { "int": 1 }
    }
  ] }
}

Rejected with runtime error: all reads the missing organic field.

{
  "cart": { "List<Object>": [
    {
      "category": { "string": "Food > Vegetables" },
      "price_usd_cents": { "int": 250 },
      "quantity": { "int": 1 }
    }
  ] }
}

7. Cart as a Pure Tree

The cart items are a tree with no common fields: category is the discriminant and every other attribute is a node field.

name tree_only_cart_guard

requires {
  # Require at least one food item.
  any(item.category under "Food" for item in evidence.cart);

  # Require every vegetable item to be organic.
  all(item.organic for item in evidence.cart
      if item.category under "Food > Vegetables");
}

A schema with organic: bool on the node Food > Vegetables confirms item.organic is reachable after narrowing.

Accepted:

{
  "cart": { "List<Object>": [
    {
      "category": { "string": "Food > Vegetables" },
      "organic": { "bool": true }
    },
    {
      "category": { "string": "Apparel > Shoes" }
    }
  ] }
}

Rejected with runtime error: all reads organic with the wrong runtime type.

{
  "cart": { "List<Object>": [
    {
      "category": { "string": "Food > Vegetables" },
      "organic": { "string": "yes" }
    }
  ] }
}

Rejected with runtime error: any reads category on every item.

{
  "cart": { "List<Object>": [
    {
      "category": { "string": "Food > Vegetables" },
      "organic": { "bool": true }
    },
    {
      "organic": { "bool": true }
    }
  ] }
}

8. Compiling with an Evidence Schema

Compiling with the evidence schema checks the accesses on the items in evidence.cart and records the minimal subshape each item must expose.

name grocery_guard

requires {
  # Bound the total quantity.
  sum(item.quantity for item in evidence.cart) <= 50;

  # Vegetables must be organic.
  all(item.organic for item in evidence.cart
      if item.category under "Food > Vegetables");
}

Evidence schema: cart holds a tree keyed by category, with common field quantity: int and organic: bool on the node Food > Vegetables.

{
  "common_fields": {
    "cart": {
      "list": {
        "object": {
          "common_fields": { "quantity": "int" },
          "variants": {
            "discriminant": "category",
            "kind": "tree",
            "cases": {
              "Food": {},
              "Food > Vegetables": { "organic": "bool" }
            }
          }
        }
      }
    }
  }
}

Compiling succeeds and records the subshape for evidence.cart items:

common              -> { quantity: int }
"Food > Vegetables" -> { organic: bool }

Rejected when compiling: declaring quantity as string in the evidence schema makes sum(item.quantity ...) ill-typed.

Rejected when compiling: a schema whose Food > Vegetables node lacks organic leaves item.organic unresolved.

9. Enum Evidence

name payment_guard

parameters {
  allowed_countries: Set<string>
}

requires {
  # Card payments must be on an allowed network.
  all(p.network == "visa" for p in evidence.payments
      if p.method == "card");

  # Card and bank payments must come from an allowed country.
  all(p.country in parameters.allowed_countries for p in evidence.payments
      if p.method in {"card", "bank"});
}

Evidence schema: payments is an enum keyed by method, with common field amount_usd_cents: int. Both card and bank add country: string, so the in {"card", "bank"} narrowing exposes country; network is reachable only under method == "card".

{
  "common_fields": {
    "payments": {
      "list": {
        "object": {
          "common_fields": { "amount_usd_cents": "int" },
          "variants": {
            "discriminant": "method",
            "kind": "enum",
            "cases": {
              "card": { "country": "string", "network": "string" },
              "bank": { "country": "string", "iban": "string" },
              "cash": {}
            }
          }
        }
      }
    }
  }
}

Compiling records the subshape for evidence.payments items:

"card" -> { country: string, network: string }
"bank" -> { country: string }

The cash variant and the unread common field amount_usd_cents are dropped. country is recorded under both card and bank because the membership check narrows to each listed variant.

Rejected when compiling: accessing p.network under p.method in {"card", "bank"}, since bank has no network field.

10. Single Product with Cross-Constraint Narrowing

The whole evidence is one product whose root is a tree. The first constraint narrows the root to a category, and the following constraints read that category’s case fields without repeating the guard.

name books_purchase_guard

parameters {
  acceptable_genres: Set<string>
  max_price_cents: int
}

requires {
  evidence.category == "Media > Books > Printed Books";
  evidence.genre in parameters.acceptable_genres;
  evidence.price_cents <= parameters.max_price_cents;
}

Evidence schema: a tree root keyed by category, with genre and price_cents on the Media > Books > Printed Books node.

{
  "variants": {
    "discriminant": "category",
    "kind": "tree",
    "cases": {
      "Media": {},
      "Media > Books": {},
      "Media > Books > Printed Books": { "genre": "string", "price_cents": "int" }
    }
  }
}

Reordering the constraints so an attribute is read before the guard that narrows to it is rejected at compile time. At runtime the constraints are evaluated independently: if the category guard is false, later reads still run and error only when their referenced fields are missing or fail runtime type checks.