Skip to main content

​
Overview

This guide walks you through creating your first TealTiger policy and observing how it behaves at runtime. By the end of this guide, you will understand:
  • How a policy is evaluated
  • How decisions are made
  • How risk scores influence enforcement
  • How reason codes explain outcomes
  • How audit and logging capture evidence
This represents the happy path for TealTiger v1.1.0.

​
What You Will Build

You will conceptually create a policy that:
  • Evaluates estimated cost
  • Considers overall risk
  • Blocks execution when thresholds are exceeded
  • Emits structured audit and logging signals
In simple terms: If estimated cost is high AND risk score is high → block the request

​
Step 1: Understand the Decision Flow

Every request evaluated by TealTiger follows the same deterministic flow:
  1. Signals are collected (cost, risk, context)
  2. Policy conditions are evaluated
  3. A decision is produced:
    • ALLOW
    • RESTRICT
    • BLOCK
  4. Actions are executed
  5. Audit and logging events are emitted
You define intent through policies — TealTiger handles execution.

​
Step 2: Define a Policy (Conceptual)

A policy in TealTiger is composed of three parts:
  • Conditions — when the policy applies
  • Actions — what happens if it applies
  • Mode — whether the policy observes or enforces
Conceptually, this policy checks:
  • Is the estimated cost above the remaining budget?
  • Is the composite risk score above an acceptable threshold?
If both conditions are true, the policy triggers.

​
Step 3: Signal Evaluation

When a request enters your system, TealTiger evaluates signals such as:
  • Estimated cost
  • Token usage
  • Risk score
  • Execution identity
  • Environment context
Example evaluated signals:
  • Estimated cost: $0.12
  • Remaining budget: $0.05
  • Composite risk score: 82
These signals are normalized and deterministic.

​
Step 4: Policy Decision

Based on the evaluated signals, the policy produces a decision. Decision outcome: BLOCK
Mode: enforce This decision is final for the request. There are no retries, no hidden overrides, and no probabilistic behavior.

​
Step 5: Reason Codes

TealTiger emits reason codes to explain why a decision occurred. Example reason codes:
  • COST.LIMIT.BUDGET_EXCEEDED
  • RISK.THRESHOLD.HIGH_RISK_SCORE
Reason codes are:
  • Stable identifiers
  • Machine-readable
  • Safe for automation
  • Consistent across logs and audits
They provide transparency without exposing sensitive data.

​
Step 6: Risk Scores

Decisions are influenced by normalized risk scores. Example:
  • Composite risk score: 82
  • Security risk: 90
  • Cost risk: 75
  • Governance risk: 40
  • Reliability risk: 20
Risk scores enable graduated enforcement instead of simple allow or deny logic.

​
Step 7: Actions Executed

Because the policy is in enforce mode, actions are executed. Typical actions include:
  • Blocking the request
  • Emitting logs
  • Recording audit evidence
  • Returning structured error responses
Actions execute only after conditions evaluate to true.

​
Step 8: Audit Event Emission

Every decision produces a structured audit event. Audit events record:
  • Policy evaluated
  • Decision outcome
  • Risk scores
  • Reason codes
  • Actions executed
  • Correlation identifiers
Audit events are versioned, redacted by default, and safe for long-term retention.

​
Step 9: Logging Behavior

In addition to audit events, TealTiger emits structured logs. By default:
  • Prompts and completions are not logged
  • Only metadata and decisions are recorded
  • Redaction rules are applied automatically
Logging provides visibility without risking data leakage.

​
Monitor vs Enforce Mode

The same policy can run in two modes.

​
Monitor Mode

  • Decisions are evaluated
  • Actions are not enforced
  • Full audit visibility is preserved

​
Enforce Mode

  • Decisions are applied
  • Blocking and transformations occur
  • Enforcement is deterministic
This allows safe rollout before full enforcement.

​
What You Learned

In this guide, you learned how:
  • Policies evaluate signals deterministically
  • Risk and cost influence decisions
  • Reason codes explain outcomes
  • Audit events provide defensible evidence
  • Logging remains safe by default
You have completed the minimum viable TealTiger workflow.

​
Next

  • See Policy Design to build richer policies
  • See Risk Scores to tune thresholds
  • See Audit and Telemetry for exporting events
  • See Configuration to control enforcement and logging