Service Mesh Platform · View 30 of 31 · 7 · Assurance
Decisions
- Deny rules are evaluated before allow rules, so a deny added in an emergency cannot be overridden by an old allow.
- A service in strict mode with no allow policy denies everything. The namespace onboarding change creates that default; a team writes explicit allows before traffic flows.
- Dry-run rules are compiled beside enforced rules and change nothing except a log line. Validation happens against live traffic, not a test fixture.
Targets
- Decision p99 ≤ 0.2 ms in-proxy. No network call in the common case.
Opt-in, later
- External authorisation (Envoy ext_authz to OPA) is Phase 3 and per service. Each service that uses it declares a latency budget and whether it fails open or closed, and the declaration is reviewed with the policy.
