What is a Decision Log?
A decision log is a specific audit log entry that records why a tool call was allowed or denied, including which policy rule matched, what conditions were evaluated, and the reasoning chain that produced the final action.
WHY IT MATTERS
Knowing that a tool call was denied is useful. Knowing why it was denied is essential. The decision log captures the full reasoning chain: which rules were candidates, which conditions were evaluated, which passed, which failed, and which rule ultimately produced the action. This transforms policy enforcement from a black box into a transparent, debuggable system.
Decision logs are indispensable during policy development. When a new policy unexpectedly denies a legitimate tool call, the decision log tells you exactly which rule matched and which condition failed. Without it, debugging policies requires guesswork — disabling rules one by one until the denial stops, then working out which condition was wrong.
For compliance and security, decision logs provide the evidentiary chain that auditors require. When asked "why was this agent allowed to create a charge for £5,000?", the decision log shows: tool-level rule X matched with priority Y, condition amount < 10000 evaluated to true, action was allow. This level of detail transforms compliance from a manual attestation process into an automated, verifiable one.
HOW POLICYLAYER USES THIS
Every tool call processed by Intercept generates a decision log entry embedded within the audit log. The entry includes: candidate rules considered (with IDs and source files), conditions evaluated (with argument values and results), the winning rule, and the final action. In verbose mode, the decision log includes the full priority-sorted rule list and the short-circuit point where evaluation stopped. Decision logs can be queried by rule ID, enabling impact analysis — "which tool calls were affected by rule X?"