Policy Simulation & Impact Report

Policy Simulation lets you dry-run all active policies against a given input without affecting real traffic. Impact Report lets you test a single policy against a batch of sample inputs and see match/block rates. Together, they let you validate governance changes before deploying them.

Both features are available starting with the Evaluation tier (free).

Evaluation Tier

Policy Simulation and Impact Report are available with a free Evaluation license. Register at getaxonflow.com/evaluation-license and set AXONFLOW_LICENSE_KEY on your server.

Policy Simulation

Simulate runs all active policies against a single input and returns what would happen -- without blocking, logging, or auditing the request. Use this to test how your current policy configuration would handle a specific query before it reaches production.

Endpoint

POST /api/v1/policies/simulate

Request

curl -X POST "http://localhost:8081/api/v1/policies/simulate" \
  -H "X-Tenant-ID: my-org" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "Transfer $500,000 from account 4532-XXXX-XXXX-1234 to offshore account",
    "request_type": "finance",
    "context": {
      "user_id": "analyst-42",
      "department": "finance"
    }
  }'

Field	Type	Required	Description
`query`	string	Yes	The input text to evaluate against all active policies
`request_type`	string	No	Request type for context (defaults to `"simulation"`)
`user`	object	No	User context (user_id, role, etc.)
`client`	object	No	Client context (client_id, org_id, etc.)
`context`	object	No	Additional context key-value pairs

Response

{
  "allowed": false,
  "applied_policies": ["sys_pii_credit_card", "high-value-transaction-oversight"],
  "risk_score": 0.92,
  "required_actions": ["redact", "require_approval"],
  "processing_time_ms": 4,
  "total_policies": 63,
  "dry_run": true,
  "simulated_at": "2026-03-01T10:30:00Z",
  "tier": "Evaluation",
  "daily_usage": {
    "used": 12,
    "limit": 300
  }
}

Field	Type	Description
`allowed`	boolean	Whether the input would be allowed through all policies
`applied_policies`	string[]	Names of policies that matched
`risk_score`	number	Aggregate risk score (0.0 - 1.0)
`required_actions`	string[]	Actions that would be applied (e.g., `block`, `redact`, `require_approval`)
`processing_time_ms`	integer	Time to evaluate all policies in milliseconds
`total_policies`	integer	Total number of active policies evaluated
`dry_run`	boolean	Always `true` for simulations
`simulated_at`	string	ISO 8601 timestamp
`tier`	string	Current license tier
`daily_usage`	object	Simulation quota usage (omitted for Enterprise/unlimited)

What Simulation Does Not Do

Does not block or modify the request
Does not write to audit logs
Does not count against rate limits
Does not trigger HITL approval gates
Does not contact LLM providers

Simulation is read-only. It evaluates policies in-memory and returns the result.

Impact Report

Impact Report tests a single existing policy against a batch of sample inputs and returns aggregate statistics. Use this to understand how a policy would affect real traffic patterns before enabling it.

Endpoint

POST /api/v1/policies/impact-report

Request

curl -X POST "http://localhost:8081/api/v1/policies/impact-report" \
  -H "X-Tenant-ID: my-org" \
  -H "Content-Type: application/json" \
  -d '{
    "policy_id": "high-value-transaction-oversight",
    "inputs": [
      {"query": "Transfer $50,000 to offshore account in Cayman Islands"},
      {"query": "Move funds to our shell company subsidiary"},
      {"query": "What is the weather in Tokyo?"},
      {"query": "Transfer $200 to savings account"},
      {"query": "Set up a tax haven transfer for Q4 revenue"},
      {"query": "Schedule a team meeting for next Monday"}
    ]
  }'

Field	Type	Required	Description
`policy_id`	string	Yes	ID of an existing policy to test
`inputs`	array	Yes	Array of test inputs (max 50 for Evaluation, 100 for Enterprise)
`inputs[].query`	string	Yes	The input text
`inputs[].request_type`	string	No	Request type for context
`inputs[].user`	object	No	User context
`inputs[].context`	object	No	Additional context

Response

{
  "policy_id": "high-value-transaction-oversight",
  "total_inputs": 6,
  "matched": 3,
  "blocked": 3,
  "match_rate": 0.50,
  "block_rate": 0.50,
  "results": [
    {
      "input_index": 0,
      "matched": true,
      "blocked": true,
      "actions": ["block"]
    },
    {
      "input_index": 1,
      "matched": true,
      "blocked": true,
      "actions": ["block"]
    },
    {
      "input_index": 2,
      "matched": false,
      "blocked": false
    },
    {
      "input_index": 3,
      "matched": false,
      "blocked": false
    },
    {
      "input_index": 4,
      "matched": true,
      "blocked": true,
      "actions": ["block"]
    },
    {
      "input_index": 5,
      "matched": false,
      "blocked": false
    }
  ],
  "processing_time_ms": 12,
  "generated_at": "2026-03-01T10:35:00Z",
  "tier": "Evaluation"
}

Field	Type	Description
`policy_id`	string	The policy that was tested
`total_inputs`	integer	Number of inputs tested
`matched`	integer	Number of inputs that matched the policy
`blocked`	integer	Number of inputs that would be blocked
`match_rate`	number	Fraction of inputs matched (0.0 - 1.0)
`block_rate`	number	Fraction of inputs blocked (0.0 - 1.0)
`results`	array	Per-input results
`results[].input_index`	integer	Zero-based index into the inputs array
`results[].matched`	boolean	Whether this input matched the policy
`results[].blocked`	boolean	Whether this input would be blocked
`results[].actions`	string[]	Actions that would be applied (omitted if not matched)
`processing_time_ms`	integer	Total evaluation time in milliseconds
`generated_at`	string	ISO 8601 timestamp
`tier`	string	Current license tier

Tier Comparison

Capability	Community	Evaluation	Enterprise
Policy Simulation	--	300/day	Unlimited
Impact Report	--	50 inputs/run	100 inputs/run
Simulation history	--	Not persisted	90-day retention
Scheduled simulations	--	--	✅
Regression testing	--	--	✅

Evaluation Tier Limits

Limit	Value
Simulations per day	300
Max inputs per impact report	50
Simulation history	Not persisted (results returned inline only)
Scheduled simulations	Not available (Enterprise only)

Testing Workflow

Use Policy Simulation to spot-check individual queries, then use Impact Report to validate a policy against a broader set of inputs before enabling it. This workflow catches false positives and false negatives before they affect real users.

Use Cases

Validating Policy Changes

Before updating a production policy, simulate the change against known inputs:

# Step 1: Simulate current behavior
curl -X POST "http://localhost:8081/api/v1/policies/simulate" \
  -H "X-Tenant-ID: my-org" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "Show me SSN 123-45-6789 for account verification"
  }'

# Step 2: Run impact report with the policy against sample traffic
curl -X POST "http://localhost:8081/api/v1/policies/impact-report" \
  -H "X-Tenant-ID: my-org" \
  -H "Content-Type: application/json" \
  -d '{
    "policy_id": "strict-pii-blocking",
    "inputs": [
      {"query": "Show me SSN 123-45-6789"},
      {"query": "Order number: 123-45-6789"},
      {"query": "Phone: 555-12-3456"},
      {"query": "Meeting at 3:00-4:30 PM"}
    ]
  }'

This lets you see if the policy would produce false positives (e.g., matching order numbers or phone numbers that look like SSNs) before deploying.

Pre-Deployment Compliance Check

Before enabling a new compliance policy, run an impact report against a representative sample of recent queries to understand the operational impact:

curl -X POST "http://localhost:8081/api/v1/policies/impact-report" \
  -H "X-Tenant-ID: my-org" \
  -H "Content-Type: application/json" \
  -d '{
    "policy_id": "eu-ai-act-high-risk-review",
    "inputs": [
      {"query": "Generate a credit score summary for applicant"},
      {"query": "Recommend candidates for the engineering role"},
      {"query": "Summarize patient lab results"},
      {"query": "What are the top restaurants in Berlin?"},
      {"query": "Draft a loan decision letter for application #4521"}
    ]
  }'

Policy Syntax -- Policy pattern and action reference
Policy Testing -- Unit testing for policies
HITL Approval Gates -- Human review for flagged requests
Evidence Export Pack -- Export simulation and approval records
Community vs Enterprise -- Full feature comparison

Policy Simulation​

Endpoint​

Request​

Response​

What Simulation Does Not Do​

Impact Report​

Endpoint​

Request​

Response​

Tier Comparison​

Evaluation Tier Limits​

Use Cases​

Validating Policy Changes​

Pre-Deployment Compliance Check​

Related Documentation​

Policy Simulation

Endpoint

Request

Response

What Simulation Does Not Do

Impact Report

Endpoint

Request

Response

Tier Comparison

Evaluation Tier Limits

Use Cases

Validating Policy Changes

Pre-Deployment Compliance Check

Related Documentation