> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy engine

> Enterprise-grade policy evaluation for B2C, B2B, B2G, and B2B2C scenarios.

Enforce compliance rules, trust requirements, and security policies across your ecosystem. Policies apply to three categories: `MINT`, `VERIFY`, and `BUNDLE_EXPORT`.

<Info>
  Looking to set up rule-based policies from the console or API? See the [issuance policies guide](/guides/issuance-policies) for creating, managing, and simulating policies without writing code.
</Info>

## Policy Templates

<CardGroup cols={2}>
  <Card title="B2C - Consumer" icon="user">
    Consumer-focused policy with trust disclosure and risk protections. - Issuer
    must be in trusted status - Trust tier must be verified\_org or higher -
    Block high/critical risk issuers - Key must be active
  </Card>

  <Card title="B2B - Enterprise" icon="building">
    Business-to-business with industry requirements and key rotation. - Issuer
    must be in trusted status - Finance/Healthcare require regulated\_issuer tier

    * Key rotation required every 180 days - Governance approvals for status
      changes
  </Card>

  <Card title="B2G - Government" icon="landmark">
    Government-grade policy with strict compliance requirements. - All
    attestations require regulated\_issuer tier - Block medium or higher risk
    issuers - Key rotation required every 90 days - Mandatory documented
    revocation reasons
  </Card>

  <Card title="B2B2C - Hybrid" icon="users">
    Hybrid policy for enterprise-to-consumer scenarios with dual disclosure. -
    Issuer must be in trusted status - Trust tier must be verified\_org or higher

    * Privacy protection: payload not stored - Consumer-friendly + enterprise
      audit details
  </Card>
</CardGroup>

## Usage

```javascript theme={null}
import { EnterprisePolicyEngine, templates } from "@truthlock/policy";

// Create engine with B2B template
const engine = new EnterprisePolicyEngine(templates.B2B);

// Evaluate policy
const result = engine.evaluate({
  tenant_id: "tenant-uuid",
  issuer_current: {
    id: "issuer-uuid",
    status: "trusted",
    trust_tier: "verified_org",
    risk_rating: "low",
    jurisdiction: "US",
    assurance_level: "standard",
  },
  key: {
    kid: "key-1",
    status: "ACTIVE",
    valid_from: "2024-01-01T00:00:00Z",
    age_days: 30,
  },
  context: {
    request_type: "mint",
    industry: "technology",
  },
});

if (!result.allowed) {
  console.log("Denied:", result.code);
  console.log("Reason:", result.compliance_explanation);
}
```

## Policy Result

```typescript theme={null}
interface PolicyResult {
  allowed: boolean;
  code: string; // e.g., "ISSUER_NOT_TRUSTED"
  reason: string; // Human-readable reason
  compliance_explanation: string; // Compliance-friendly explanation
  disclosures?: {
    type: "warning" | "info" | "critical";
    message: string;
    audience: "consumer" | "enterprise" | "all";
  }[];
}
```

## Policy Versioning

Each policy instance has a unique hash computed from the template and rules. This hash can be stored with attestations for audit purposes.

```javascript theme={null}
const engine = new EnterprisePolicyEngine(templates.B2G);

console.log("Policy hash:", engine.getPolicyHash());
// => "a1b2c3d4e5f6g7h8"

console.log("Policy version:", engine.getPolicyVersion());
// => "1.0.0-1704067200000"
```

## Policy categories

| Category        | Applies to                                        |
| --------------- | ------------------------------------------------- |
| `MINT`          | Attestation minting requests                      |
| `VERIFY`        | Verification requests                             |
| `BUNDLE_EXPORT` | Proof-bundle export and data-portability requests |

`BUNDLE_EXPORT` policies are evaluated whenever a user or API client requests a proof bundle download or submits a data-portability export. Use them to restrict exports by jurisdiction, trust tier, risk rating, or any other field available in the evaluation context. See [export control policies](/guides/issuance-policies#export-control-policies) for examples.

## Policy lifecycle

Every policy has a status that controls enforcement:

| Status     | Behavior                                              |
| ---------- | ----------------------------------------------------- |
| `DRAFT`    | Saved but not enforced — use while iterating on rules |
| `ACTIVE`   | Enforced on every matching request                    |
| `DISABLED` | Temporarily turned off without deleting               |

Only `ACTIVE` policies are evaluated at request time. Each status change increments the policy version, which is recorded alongside every evaluation decision for auditability.

A typical lifecycle:

1. **Create as `DRAFT`** — build and refine rules without affecting live traffic.
2. **Simulate** — test the policy against sample inputs.
3. **Set to `ACTIVE`** — enforcement begins immediately.
4. **Set to `DISABLED`** — pause enforcement without losing the policy definition.
5. **Delete** — remove the policy when no longer needed.

<Info>
  See the [issuance policies guide](/guides/issuance-policies#policy-lifecycle) for step-by-step instructions on managing policy status transitions.
</Info>

## Simulating policies

Test how a policy evaluates a given input before deploying it. See the [policy simulator](/guides/issuance-policies#simulating-a-policy) for console and API usage.