Combinators

Compose policy conditions with any_of (OR), all_of (AND), and not (NEGATE) combinators.

Compose policy conditions using boolean logic. Combinators are condition object shapes (not imported functions) that you use directly in policy rule conditions. any_of, all_of, and not let you build arbitrarily complex rules from simple building blocks.

Condition Shapes

Shape	Signature	Description
any_of	`{ type: "any_of", conditions: PolicyCondition[] }`	OR combinator. Matches if at least one condition is true. Short-circuits on first match.
all_of	`{ type: "all_of", conditions: PolicyCondition[] }`	AND combinator. Matches only if every condition is true. Short-circuits on first failure.
not	`{ type: "not", condition: PolicyCondition }`	NEGATE combinator. Inverts the result of a single condition.

Basic Usage

// OR — matches if ANY condition is true
const canUseEither = {
  type: 'any_of',
  conditions: [
    { agentLevel: 'senior' },
    { department: 'engineering' },
  ],
};

// AND — matches if EVERY condition is true
const mustSatisfyAll = {
  type: 'all_of',
  conditions: [
    { agentLevel: 'senior' },
    { department: 'engineering' },
    { region: 'us-east' },
  ],
};

// NEGATE — inverts the condition
const notIntern = { type: 'not', condition: { agentLevel: 'intern' } };

Nested Composition

Combinators nest freely. Build complex access control logic by composing simple conditions into trees.

const maintenancePolicy = {
  type: 'all_of',
  conditions: [
    { tool: ['db.drop', 'db.truncate', 'fs.deleteAll'] },
    {
      type: 'not',
      condition: {
        type: 'all_of',
        conditions: [
          { agentLevel: 'senior' },
          { timeWindow: { start: 2, end: 4 } },
        ],
      },
    },
  ],
};

Note: Evaluation short-circuits: any_of stops at the first true condition, all_of stops at the first false. This keeps enforcement fast even with deep nesting.

Full Example

import { createGovernance } from 'governance-sdk';

const gov = createGovernance({
  rules: [
    {
      name: 'production-safeguard',
      condition: {
        type: 'all_of',
        conditions: [
          { environment: 'production' },
          { type: 'not', condition: { agentLevel: 'admin' } },
        ],
      },
      action: 'requires_approval',
      priority: 50,
    },
    {
      name: 'flexible-access',
      condition: {
        type: 'any_of',
        conditions: [
          { role: 'deployer' },
          { team: 'platform' },
        ],
      },
      action: 'allow',
      priority: 30,
    },
  ],
});