The policy engine
Each field is classified by what it contains and how sensitive it is. Dynomo resolves the applicable policy for the current boundary, then allows, masks, tokenizes, omits, or blocks the field before data moves.
Cached policy evaluation runs in process — no synchronous policy call for every field.
The platform baseline cannot be weakened by any workspace.
Versioned rules can be assigned across the targets a team owns.
Local overrides can add protection, but are stricter-only by default.
The full hierarchy and winning rule remain visible in the UI.
Rules are matched top-down. BLOCK and OMIT are terminal — they short-circuit remaining evaluation for that field.
Not a configuration step. Not a node you remember to add. A system that evaluates at every boundary and fails closed when it can't.
Write governance rules once and assign them anywhere — to a workspace, a connector, a specific workflow, or a single node. Rules are versioned, immutable once published, and reusable across your entire stack.
Policies aren't optional nodes in a workflow. They enforce automatically before external API calls, AI prompts, connector writes, log persistence, and preview rendering. There's no path around them.
When a policy is unavailable or evaluation fails at an external AI or API boundary, Dynomo stops the operation. Protected values never leave in degraded mode. Logs get an emergency redactor instead of silence.
Policies move through Draft → Published → Archived. Published versions are immutable — a new draft is required to change them. Audit records capture exact version IDs, so you can always explain which rule made which decision.
Policies stack: System → Workspace → Connector → Workflow → Node. Mandatory system guardrails cannot be weakened at lower scopes. See the full resolved hierarchy and the winning rule for any field, in any context.
Every evaluation records context, policy version IDs, action counts by category, and blocked/degraded state. Original protected values, restored tokens, and connector credentials are never written to audit storage.
