Loading…
Open-Policy Exchange
~6 min to deploy
Make Scenario Execution Gate
Evaluate any Make scenario before its protected module runs, using the HTTP V4 request recipe and the bearer key in Make's keychain.
For: Ops teams building scenarios in Make that touch money or customer records
SOC 2 CC8.1ISO 27001 A.5.15Scenario evidence
What it enforces
Protected-module gate
Escalates when a protected module would run above the encoded value threshold.
Idempotency requirement
Restrains a scenario run that arrives without a stable idempotency key.
Entitlement check
Blocks a scenario acting on a record the connected account is not entitled to.
make-scenario-execution-gate.yaml
# Make Scenario Execution Gate
# Fork: paste the HTTP V4 request ahead of the protected module and map the
# response's verdict + dossier id into the scenario router.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
name: make-scenario-execution-gate
surface: make
workflow_key: scenario_execution
standards: [SOC2-CC8.1, ISO27001-A.5.15]
defaults:
mode: shadow
emit_dossier: true
rules:
- name: protected_module_gate
when: "module.protected == true"
decision: |
ALLOW IF amount_usd < 2000
ESCALATE IF amount_usd < 25000
BLOCK OTHERWISE
reason_code: protected_module_over_threshold
- name: idempotency_requirement
when: "always"
decision: |
RESTRAIN IF request.idempotency_key == null
ALLOW OTHERWISE
reason_code: missing_idempotency_key
- name: entitlement_check
when: "always"
decision: |
BLOCK IF record.owner_org != connection.org_id
ALLOW OTHERWISE
reason_code: record_not_entitled
Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.
How to install it
Follow the install path for this surface, then paste the forked YAML as your policy config.
What to do next
This recipe is one step in a path. The same five steps apply to every recipe in the exchange.
- Simulate this recipe
Run the policy against a realistic action in the browser. Push it past what the rules allow and watch the verdict come back. No account.
- View the signed Decision Dossier
See exactly what was decided and why: the rule that fired, the evidence it read, the policy version in force, and an Ed25519 signature you can verify yourself.
- Deploy in shadow mode
Measure what the policy would have caught on your own traffic without touching the live path. Every recipe defaults to shadow, so the first deployment carries no execution risk.
- Connect a real workflow
Point the same policy at the system where the action actually originates — a checkout, an ERP posting, a Zap, an agent's tool call.
- Share the verified result
Publish the proof: a public verification link, an embeddable badge, a PR comment, or an anonymized shadow-mode finding. This is how the next person discovers Decionis.