Evaluation Flow

Every call to engine.evaluate() flows through a deterministic three-stage pipeline. Understanding this flow helps you debug policy behavior, optimize performance, and predict governance outcomes.

---

​

Flow Diagram

---

​

Stage 1: Pre-Evaluation (Sequential)

Pre-evaluation checks run in order. If any check fails, the pipeline short-circuits — no modules are invoked, no evidence is emitted. This is the fastest path to DENY. Total pre-evaluation: < 2ms Key property: If no v1.3 features are configured (no FREEZE, no NHI, no temporal), pre-evaluation is a no-op and the pipeline behaves identically to v1.2.

---

​

Stage 2: Module Evaluation (Parallel)

All registered modules evaluate concurrently via Promise.allSettled (TypeScript) or asyncio.gather (Python). Each module returns independently — no module waits for another. Parallel execution: TealGuard, TealSecrets, TealClassifier, TealDrift, TealMonitor, TealRegistry all run simultaneously. The engine waits for all to complete, then merges results.

​

Merge Strategy

Each module returns a ModuleResult with an action and severity score. The engine selects the highest severity action:

​

Fail-Closed Default

If a module throws an exception during evaluation:

• fail_closed (default): Module failure → DENY
• fail_open: Module failure → treated as ALLOW (use with caution)

---

​

Automation Level Resolution

After merge, the automation level determines the final decision action: PENDING decisions generate an approval token with a configurable TTL. The request is held until approveDecision() or rejectDecision() is called.

---

​

Stage 3: Post-Evaluation (Async)

After the decision is computed and returned to the caller, post-hooks fire asynchronously: Post-hooks do not affect the decision or add latency to the response.

---

​

PLAN_ONLY Mode

When mode: 'PLAN_ONLY' is set in the evaluation context:

• Pre-evaluation runs normally
• Modules evaluate normally
• Merge and automation resolution run normally
• But: No evidence is emitted, no approval tokens are created, decision.plan = true

Use for agent planning loops and UI previews.

---

​

Backward Compatibility

evaluateV12() is preserved and bypasses the v1.3 pipeline:

• No pre-evaluation (no FREEZE, no NHI, no temporal)
• Parallel module evaluation (same as v1.2)
• No automation levels (direct merge → decision)
• No post-hooks

Existing v1.2 code works unchanged.

---

​

Performance Summary

---

​

Related Documentation