Governance Preview

Evaluate what governance would do to a plan without actually mutating the run status.

What Is Governance Preview?

Governance preview lets you evaluate all three governance layers (OPA policies, approval rules, external checks) against a completed plan without changing the run’s status. It’s a dry-run evaluation.

When to Use It

Before applying a plan — see what approvals would be required
After writing new policies — verify they match as expected
During policy development — test policies against real plan data
For audit purposes — document what governance would do without taking action

Running a Preview

POST /runs/{id}/governance-preview

Requirements:

Run must be a plan type
Run status must be completed, pending_approval, or rejected

Response

{
  "policy_results": [
    {
      "policy_set_name": "production-safety",
      "policy_name": "no-destroy-prod",
      "enforcement": "mandatory",
      "passed": false,
      "violations": ["Destroying a database instance in production is not allowed"]
    }
  ],
  "approval_preview": {
    "would_require_approval": true,
    "builtin_rules": [
      {
        "name": "production-destroy-approval",
        "min_approvals": 1,
        "stage": 1
      }
    ],
    "opa_requirements": [
      {
        "team": "security",
        "min": 1,
        "stage": 1,
        "reason": "IAM role creation requires security review"
      }
    ],
    "external_providers": [
      {
        "id": "provider-uuid",
        "name": "compliance-platform"
      }
    ]
  },
  "mandatory_violations": 1
}

Interpreting the Response

Field	Description
`policy_results`	Full policy evaluation results with violations
`approval_preview.would_require_approval`	Whether any approval would be required
`approval_preview.builtin_rules`	Matching approval rules
`approval_preview.opa_requirements`	Approval requirements from Rego `require_approval` rules
`approval_preview.external_providers`	External check providers that would be called
`mandatory_violations`	Count of mandatory policy violations

If mandatory_violations > 0, the run would be rejected. If would_require_approval is true, the run would enter pending_approval.

Clearing Old Results

The preview clears old policy_results before re-evaluation, so you always get fresh results.