CJIS Mode

The cjis-mode policy runs in the input phase. The input must have a verified identity with a subject and organization. It must also have an active proof, the configured session lifetime, and the necessary MFA assurance. Access logging writes durable local decision evidence before an allow result.

Phase and verdicts

• Phase: input
• Possible verdicts: allow, block

Configuration

pack:
  name: cjis-mode-example
  version: 1.0.0
  enabled: true
policies:
  chain:
    - cjis-mode
policy:
  cjis-mode:
    require_auth: true
    access_logging: true
    session_timeout_minutes: 30
    required_assurance: multi_factor

Fields

Field	Type	Default	Notes
require_auth	boolean	true	Blocks when a verified identity is missing. Authorization and X-User-ID headers do not satisfy this control.
access_logging	boolean	true	Writes durable cjis.access decision evidence before an allow result.
session_timeout_minutes	integer	30	Maximum remaining proof lifetime from 1 through 1440 minutes. A longer lifetime causes cjis.session_freshness_exceeded.
required_assurance	string	multi_factor	Minimum MFA assurance: multi_factor or phishing_resistant.

How it works

1. Give the gateway a verified policy identity from an API token, runtime token, or signed assertion.
2. Subject and organization must be available on that verified identity.
3. The proof must contain a known expires_at that is in the future.
4. Remaining proof lifetime must not exceed session_timeout_minutes.
5. Assurance must be equal to or more than required_assurance.
6. When access_logging is true, the evaluator writes durable evidence before it returns allow.

Behavior notes

• A header alone is not sufficient.
• Durable audit delivery failures block with cjis.audit_delivery_failed.
• Add case-privacy or a PII control for criminal justice content.

Next steps

• Case Privacy policy — redact case identifiers alongside CJIS gating
• PII Detector policy — protect sensitive personal data
• Policies overview — policy chain architecture