Verdicts

The four decisions a latch can return, and what your runtime must do with each.

Every authorize call resolves to exactly one verdict. The PDP’s live taxonomy is four values:

Verdict	mayContinue	Meaning	Your runtime must…
ALLOW	✅	No violation	Continue. On an action, use the returned permitId.
WARN	✅	Allowed but rewritten/flagged	Continue using transformedContent, keep the log.
BLOCK	❌	Prohibited	Stop the step; withhold the response or action.
ESCALATE	❌	Needs a human	Hold pending a reviewer; do not deliver or execute.

mayContinue is a convenience the SDK derives: it is true for ALLOW and WARN, false for BLOCK and ESCALATE.

Decision shape

interface PolicyDecision {
  verdict: "ALLOW" | "WARN" | "BLOCK" | "ESCALATE";
  stage: string;               // input | context_egress | output | delivery | action
  policyId: string;            // which latch fired, e.g. "latch-1"
  rule: string;                // human-readable rule name
  reason: string;              // why this verdict
  transformedContent?: string; // present on WARN rewrites (e.g. sensitive fields redacted)
  permitId?: string;           // present only on ALLOW + action
  mayContinue: boolean;        // ALLOW || WARN
}

Handling each verdict

function apply(decision: PolicyDecision, draft: string): Outcome {
  switch (decision.verdict) {
    case "ALLOW":
      return { deliver: draft };
    case "WARN":
      // The PDP rewrote the content; always prefer the transformed version.
      return { deliver: decision.transformedContent ?? draft };
    case "BLOCK":
      return { deliver: safeRefusal(decision.reason) };
    case "ESCALATE":
      queueForReviewer(decision);
      return { deliver: holdMessage() };
  }
}

On WARN you must use transformedContent if it is present. That is where the PDP hands back, for example, a redacted version of the context with non-essential identifiers removed. Ignoring it means delivering the unredacted original, a policy violation you were just warned about.

Verdict → delivery mapping in the evidence feed

Each decision is logged with a delivery label so auditors can read outcomes at a glance:

Verdict	Logged delivery
ALLOW (action)	Action authorized
ALLOW (text)	Safe response delivered
WARN	Delivered with warning
ESCALATE	Held pending reviewer
BLOCK	Response or action withheld

A note on client enums

The reference Kotlin client (AkharaPolicy.kt) additionally defines REWRITE and PAUSE for forward-compatibility. The PDP’s shipped taxonomy is the four verdicts above, treat WARN as the rewrite verdict. If you build a custom client, map any unknown verdict to a fail-closed BLOCK rather than continuing. See Fail-closed.

For how a verdict is produced (what the PEP sends and how the latch decides), see Tool-call interception. For where verdicts go afterward, see Audit and evidence.