GovOPlaN/govoplan-policy
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: preview governed policy impact

Browse Source
This commit is contained in:
zemion
2026-08-20 20:27:17 +02:00
parent be5e3a7d72
commit 861e9b8b8d
10 changed files with 1232 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+12
View File
@@ -19,6 +19,18 @@ activation. Optional View-ID and surface-ID ceilings are intersected across the
scope path, and the UI displays effective limits and provenance. Lower scopes
can narrow but never broaden an ancestor restriction.
Before saving a View-policy draft, administrators can call
`POST /api/v1/admin/policy-impact/preview` with one to ten explicitly selected,
bounded subject populations. The dry run does not persist the proposal. It
groups newly allowed, newly denied, unchanged, and indeterminate effects and
reports complete, sampled, truncated, unavailable, or permission-hidden
coverage with rule and source provenance. Aggregate counts follow normal
policy-read authority; resource details additionally require
`policy:impact:details`. System-wide View-policy commits require a login less
than 15 minutes old. Preview and commit are recorded as separate audit events.
Optional modules contribute subjects through the Core provider contract, so
Policy never imports their implementation.
Policy decision and provenance payloads use the shared kernel DTOs documented
in [docs/POLICY_DECISION_PROVENANCE.md](docs/POLICY_DECISION_PROVENANCE.md)
and `/mnt/DATA/git/govoplan-core/docs/POLICY_CONTRACTS.md`.