Policy

Policy — contract and behavior

• Policy is evaluated before decryption or mutation so denied operations do not create plaintext side effects.
• Programmatic surfaces are stricter than the local operator CLI and cannot assume interactive intent.
• Policy changes are themselves auditable and must not rewrite prior journal entries.
• A policy rule references stable item, recipient, workload, and operation identities rather than display text.