Pipeline · Phase 6
External Scoring — your enterprise policy gets the final word.
Optional. When enabled, Nio POSTs the action context to your HTTP endpoint and uses the returned score in the weighted average. Use this for compliance routing (HIPAA, SOC2), DLP integration, or any policy specific to your org that doesn't belong in shared rules.
| Property | Value |
|---|---|
| Latency | configurable (HTTP timeout) |
| Scope | All guarded actions (when enabled) |
| Score weight | scoring_weights.external — default 2.0 (tie-breaker) |
| Default state | disabled — needs explicit enable + endpoint |
| Short-circuit | any CRITICAL finding → deny immediately |
Enable
guard:
external_analyser:
enabled: true
endpoint: "https://policy.internal.example.com/score"
api_key: "..." # optional Bearer token
timeout: 3000 # msFor local development, the repo bundles a mock scorer at http://localhost:9090.
Wire format
Nio sends a POST to endpoint with the action context and expects a JSON response with at least a score field in [0, 1]. Response example:
POST /score
→ { "tool": "Bash", "command": "aws s3 sync …" }
← { "score": 0.94, "reason": "production bucket" }Why the weight is 2.0
Default weight is doubled so your enterprise rules carry more authority than the generic phases. If multiple phases score moderately, Phase 6 acts as the tie-breaker. Lower it if you want it to be advisory only; raise it if you want it to dominate.
Use cases
- DLP — your DLP service knows what data classes are in this repo; it can score writes that touch sensitive fields higher.
- Compliance routing — flag commands that touch HIPAA / SOC2 / PCI paths even if they look benign.
- Org allowlists — your internal trusted-domain list, validated per-request rather than baked into config.
- Audit trail signing — sign the decision with your KMS so the audit log is non-repudiable.