Skip to content

Rules as Code SDK

Rules as Code SDK

Manage enforcement as versioned bundles of rules, keep them in Git, and deploy them atomically via the SDK or REST API. Xybern diffs your bundle against the current state and creates, updates, or removes rules automatically, with full Provenance Vault tracking. This is the code / CI layer beneath the Charter, for teams that want to manage enforcement declaratively rather than click in the dashboard.

Concept Description
Rule A single enforcement rule (same shape as a rule created from the Charter)
Rule bundle A versioned collection of rules deployed as one atomic unit
Deploy Create, update, and remove rules from a bundle, POST /v1/enforce/rule-bundles
Rollback Revert to the previous bundle version, POST /v1/enforce/rule-bundles/:name/rollback
Validate Dry-run a bundle without deploying, POST /v1/enforce/rule-bundles/validate
Source hash SHA-256 fingerprint of the bundle, so redeployments are idempotent

Deploy a rule bundle

Each rule in the bundle uses the same shape as a rule created from the Charter (policy_type, decision, action_types, conditions, ...).

from xybern import Xybern

client = Xybern(api_key="xb_your_key")

rules = [
    {"name": "Block untrusted traders", "policy_type": "threshold",
     "action_types": ["execute_trade"], "decision": "block",
     "conditions": {"trust_below": 50}},
    {"name": "Weekend deploy freeze", "policy_type": "temporal",
     "action_types": ["deploy:*"], "decision": "escalate",
     "conditions": {"blocked_days": [6, 7]}},
    {"name": "No personal data leaves the org", "policy_type": "semantic",
     "action_types": [], "decision": "block",
     "conditions": {"semantic_rule": "the action sends personal data outside the organisation",
                    "min_confidence": 0.6}},
]

# Deploy to live enforcement
result = client.enforce.deploy_rule_bundle(
    name="finance-controls", version="2.0.0", policy_definitions=rules)
# → {"ok": true, "summary": {"created": 3, "updated": 0, "deleted": 0}}

# Deploy in shadow mode (observe only, never enforced)
result = client.enforce.deploy_rule_bundle(
    name="finance-controls", version="2.0.0", policy_definitions=rules,
    deploy_mode="shadow")

Redeploy a new version and Xybern auto-diffs against the previous one, replacing the managed rules atomically:

result = client.enforce.deploy_rule_bundle(
    name="finance-controls", version="2.1.0", policy_definitions=updated_rules)
# → {"summary": {"created": 0, "updated": 1, "deleted": 2, "unchanged": 1}}

Validate without deploying

validation = client.enforce.validate_rule_bundle(rules)
# → {"ok": true, "valid": true, "count": 3}

Roll back

result = client.enforce.rollback_rule_bundle("finance-controls")
# → redeploys the previous version's rules

Delete a bundle

result = client.enforce.delete_rule_bundle("finance-controls")
# → removes the bundle and all its managed rules

REST API reference

  • POST /v1/enforce/rule-bundles, deploy a rule bundle
  • GET /v1/enforce/rule-bundles, list all bundles
  • GET /v1/enforce/rule-bundles/:name, get a specific bundle
  • POST /v1/enforce/rule-bundles/:name/rollback, roll back to the previous version
  • DELETE /v1/enforce/rule-bundles/:name, delete a bundle
  • POST /v1/enforce/rule-bundles/validate, dry-run validation

The older /v1/enforce/policy-packs paths and the *_policy_pack SDK methods remain as back-compatible aliases.

Dashboard

The Rules as Code view shows every deployed bundle with its version, rule count, deploy mode, source hash, and deployment time. From there you can roll back or delete a bundle in one click. Rules deployed this way also appear in the Rules view tagged with the Pack source.