policy

Embeds the Praxis Policy Engine in-process to enforce multi-source identity, APL route policy, RFC 8693 token exchange, field redaction, session taint, audit emission, and (under body_access: read_write) request / response body rewriting. Content scanning is a host plugin the engine dispatches, not a bundled one.

Requires Cargo feature: policy-engine.

Configuration Notes

Registered under the YAML filter name policy. The policy-engine cargo feature is on by default; --no-default-features leaves the filter out.

A single request can carry multiple identity sources — user JWT in Authorization, agent JWT in X-Agent-Token, workload JWT in X-Workload-Token, etc. Each registered identity plugin reads its own configured header and contributes to a typed Extensions context.

On the body phase, the filter consumes protocol classifier filter metadata (from the praxis-ai package) to dispatch the matching CMF hook chain. APL routes (declared in the policy document) gate the tool/prompt/resource call by role, attribute, or Cedar PDP decision. delegate(...) steps mint audience-scoped tokens (RFC 8693) that the allow path attaches as upstream headers.

Policies with llm: routes authorize the top-level request model through cmf.llm_input, without classifier metadata. Missing, unlisted, and ambiguous models fail closed by default.

body_access: read_write enables the JSON-RPC re-serialization round-trip so APL field mutators (redact(), assign()) rewrite the upstream request body and the downstream response. It also enables cmf.llm_output for non-streaming inference responses. APL field mutators do not rewrite inference bodies.

Response-body hooks run on a small dedicated runtime while the worker waits, for at most twice the engine’s per-plugin timeout (engine_settings.plugin_timeout, so 60 seconds by default). A hook that does not finish in time is aborted and the response fails under the filter’s failure_mode: closed truncates the response, open passes the body through unfiltered.

Outbound policy calls share the proxy’s sub-request limits and circuit breaker, use HTTP/1.1, and keep a separate 1 MiB response ceiling. Calls made by response-body hooks use their own pool on the dispatch runtime, with the same connection limit but no circuit breaker. TLS uses the platform trust store; cluster private CAs and client certificates do not apply. A private destination requires trusted_private_endpoints for a specific host, or allow_private_idp to relax every callout.

An endpoint URL may name an IP address over http, but not over https: an IP carries no SNI, and Pingora peers skip certificate verification entirely when SNI is empty. Use a hostname for https.

Praxis filter configs are flat: the filter’s typed fields sit directly under the - filter: entry alongside the structural keys (name, conditions), not nested under a config: wrapper. See examples/configs/security/policy.yaml for a runnable example.

The referenced YAML is the policy document — plugins, routes, and identity-source declarations. The filter loads it once at construction and rejects misconfigured policy at server startup (fail-fast rather than at first request).

Configuration

Example

filter: policy
config_path: /etc/praxis/policy.yaml
body_access: read_write       # optional; default read_only
require_protocol_metadata: true    # optional; default true
init_timeout_secs: 30         # optional; default 30
max_buffer_bytes: 10485760
llm:
  require_model: true
  require_route: true
  provider: openai