Detection and Decision Flow

Two related capabilities work together to keep every AI tool visible: detection finds tools nobody registered, and the decision engine decides what happens once a request arrives.

Default posture: allow, but never invisible

OpenProdkt is opt-in, not default-deny. Nothing is blocked automatically — every restriction comes from a policy you write:

• An unregistered asset is allowed, and the attempt is recorded as a discovery for your team to review.
• A registered asset with no matching policy is allowed.
• When multiple policies match, the most restrictive outcome wins: deny beats approval_required beats allow.

This means nothing you haven't explicitly restricted gets silently blocked — but nothing runs invisibly either. Unregistered and ungoverned activity is always surfaced.

From detection to governance

• Detection observes traffic and surfaces tools nobody registered. It never blocks or approves anything by itself — it only queues the finding for a human to promote or skip.
• Promotion turns a discovery into a governed asset, ready to have policies attached.
• Policy evaluation runs for a registered asset that has at least one policy assigned, and produces the final outcome. A registered asset with no assigned policies is allowed with reason no_policies_assigned, is recorded in decision history, and is not billed.

Why this matters

• Nothing enters your environment invisibly — unknown tools are surfaced, not ignored.
• You decide what to restrict. Governance is additive: you write policies for the workflows that need approval or denial.
• Promoting a discovery into an asset is the moment a tool becomes eligible for policy enforcement.

See Policy Engine for how policies are authored and evaluated, and Developer Guide for how to handle each outcome in your application.