> ## Documentation Index
> Fetch the complete documentation index at: https://docs.visiqlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Unified Rules

> One rule surface and one evaluation call over every governed operation — action, retrieval, and delegation — folded into a single rules table and a single decision vocabulary.

Action, retrieval, and delegation are not three engines — they are one engine evaluating one event against the **operations** it carries. The unified surface is the operation-native way to manage that engine: a single `rules` collection whose every row declares which operations it applies to, and a single `POST /evaluate` call that spans every facet with one decision vocabulary.

<Note>
  The per-facet surfaces still exist and are **not** deprecated. The action (`/allow/*`) and retrieval (`/recall/*`) rule-management and evaluation endpoints are permanent, additive compatibility aliases over the same `rules` table. Use whichever surface fits — a rule created here is visible there, and vice versa.
</Note>

***

## One rule, many operations

Every rule carries an `operations[]` array — its `applies_to` set, drawn from `action`, `retrieval`, and `delegation`. A rule can target one operation or several:

* A rule with `operations: ["action"]` governs tool calls.
* A rule with `operations: ["retrieval"]` governs retrieved context.
* A rule with `operations: ["delegation"]` governs agent-to-agent handoffs.
* A rule with `operations: ["retrieval", "action"]` governs a hybrid read-then-write tool with one decision.

Because all facets share one table, listing, creating, updating, and deleting rules is one set of endpoints — `GET/POST /rules`, `GET/PUT/DELETE /rules/:id` — with an optional `?operations=` filter to scope a listing to a facet.

***

## One decision vocabulary

The unified `POST /evaluate` call returns outcomes from the full union set:

| Outcome             | Meaning                                                                                                      |
| ------------------- | ------------------------------------------------------------------------------------------------------------ |
| `permit`            | The event proceeds unchanged                                                                                 |
| `deny`              | The event is blocked or suppressed                                                                           |
| `approval_required` | The event pauses for a human decision                                                                        |
| `redact`            | Retrieved content proceeds with fields masked                                                                |
| `escalate`          | The retrieval is recorded for review; it passes through (masked, if the rule so chooses) rather than pausing |
| `mask`              | An action proceeds with named arguments redacted                                                             |

A single-facet event resolves to one outcome. A **hybrid** event (for example `operations: ["retrieval", "action"]`) is evaluated on both facets and combined **most-restrictively** — a deny on either facet denies the whole event (fail-closed).

***

## One bundle for the SDK

The tagged SDK runtime pulls one bundle from `GET /rules/bundle` covering both the action and retrieval facets, and evaluates every event locally against it — the same policy interpreter the server runs, so local and remote decisions agree by construction. The bundle carries the agent's server-authoritative mode and attributes, a content-addressed `version` ETag, and a `min_dialect` floor: an SDK too old to honour the bundle's constructs refuses it and fails closed rather than mis-applying a restriction it cannot understand.

***

## Next steps

<CardGroup cols={2}>
  <Card title="API Reference" icon="code" href="/rules/unified/api-reference">
    Unified rule CRUD, the SDK bundle, and the `POST /evaluate` call.
  </Card>

  <Card title="Action Governance" icon="shield-halved" href="/rules/action/api-reference">
    The action facet and its compatibility endpoints.
  </Card>

  <Card title="Retrieval Governance" icon="eye" href="/rules/retrieval/api-reference">
    The retrieval facet and its compatibility endpoints.
  </Card>

  <Card title="Delegation Governance" icon="share-nodes" href="/rules/delegation/api-reference">
    The delegation facet and the grant lifecycle.
  </Card>
</CardGroup>