<!-- SPDX-License-Identifier: Apache-2.0 -->
**Status:** stable · **Owner:** Developer Relations · **License:** Apache-2.0

# `policy-resolver` — map a policy-engine verdict onto the KYE DecisionOutcome set

Starter for a **provider-agnostic** resolver: pick a policy engine by
`engine_kind` (Cedar / OPA / Cerbos / AWS Verified Permissions / AgentCore),
evaluate it, map its native effect onto the **single locked KYE DecisionOutcome
set**, and seal the raw verdict in the evidence so the mapping is replay-provable.
Keep your existing engine — KYE sits above all of them. **One resolver, many
provider projections** (§0.10).

Companion playbook:
[policy-resolver-integration](../../playbooks/policy-resolver-integration.md).

## Run

```bash
kye agent new my-agent --template policy-resolver
cd my-agent && npm install && npm start
# pick the provider:
KYE_POLICY_ENGINE=aws-verified-permissions npm start
KYE_POLICY_ENGINE=agentcore npm start
```

The provider registry (`src/providers.ts`) holds one `ProviderAdapter` per
engine, each normalising its native verdict to a neutral effect; the resolver in
`src/agent.ts` maps that onto the public `Decision` vocabulary. Swap a provider's
`evaluate` for a real Cedar / OPA / Cerbos / AVP / AgentCore call — the mapping
discipline is unchanged. The provider names mirror the canonical `engine_kind`
enum.

## The locked DecisionOutcome mapping

| Native effect | → KYE DecisionOutcome |
|---|---|
| allow | `allow` |
| deny | `deny` |
| conditional / obligated | `allow_with_constraints` |
| escalation required | `require_approval` |
| timeout / error | `deny` (fail-closed) |

Outcomes are the public vocabulary
(`https://kyeprotocol.com/schemas/common.json#/$defs/Decision`). Never invent
local outcome strings. Reference adapters:
[`public/examples/policy-engine-adapters/`](../../../examples/policy-engine-adapters/),
[`@kye/connector-cerbos`](../../connector-cerbos/).

## Files

- `src/agent.ts` — the KYE-wrapped resolver + the single locked-outcome mapping.
- `src/providers.ts` — the provider-agnostic registry (Cedar / OPA / Cerbos / AVP / AgentCore).
- `src/mock-policy-engine.ts` — backward-compatible shim delegating to the registry.
- `package.json` — depends on `@kye/agent-dev-kit`.