Skip to main content

Flagged review configuration

flagged-review is an output policy. It can send uncertain content to a second reviewer or request a safe response.

The policy can also immediately emit an escalation verdict.

Use stream: false for each request that uses this policy. The gateway rejects a streaming request with streaming.policy_cannot_enforce when flagged-review is in the applicable chain.

Configuration structure​

policies:
  chain:
    - prompt-injection
    - flagged-review
    - audit-logger

policy:
  prompt-injection:
    embedding_threshold: 0.6
    response:
      action: block

  flagged-review:
    mode: judge
    provider:
      name: review-llm
      endpoint: https://api.openai.com/v1/chat/completions
      model: your-openai-review-model
      secret_key_ref:
        env: VERDICTAN_OPENAI_REVIEW_KEY
      timeout_ms: 5000
    recursion_depth_max: 1
    provider_isolation: true
    rationale_capture: true

Review modes​

ModeRuntime behavior
judgeThe policy calls the review provider for a structured verdict.
review_and_returnThe policy calls the review provider. It must include reviewed_response when the verdict is allow or warn.
audit_onlyThe policy calls the review provider for audit data. It does not change the returned response.
escalateThe policy returns an escalation result without a review-provider call.

Field reference​

FieldTypeDefaultNotes
modestringjudgejudge, review_and_return, audit_only, escalate
provider.name / provider.idstringmode-dependentThe policy accepts name or id. The default is flagged-review, or human_escalation in escalate mode.
provider.endpointstringhttps://api.openai.com/v1/chat/completionsProvider modes use this field.
provider.modelstringgpt-5.4-miniIn escalate mode, the default value is manual_review.
provider.secret_key_refobject—This field accepts only env on this surface. It rejects store.
provider.timeout_msinteger5000Provider modes use this field.
recursion_depth_maxinteger1The runtime changes values below 1 to 1. Configuration validation does not apply a constant maximum.
provider_isolationbooleantrueReview fails if it uses the primary path provider and endpoint.
rationale_capturebooleantrueWhen true, this field captures rationale from the reviewer payload.
prompt_templatestringbuilt-inThis field supports {input}, {output}, {reason_code}, and {mode} placeholders.

Reviewer response​

For provider modes, the reviewer response must be JSON. It must contain these fields:

  • verdict: allow, warn, block, or escalate
  • review_summary: a short summary for the operator
  • rationale: a short cause, which the policy uses when rationale_capture: true
  • reviewed_response: a necessary field for review_and_return when the verdict is allow or warn

Use verdict. Do not use decision as a reviewer response field.

Each response that reaches this policy starts the configured review operation. An earlier block or escalation stops the chain before this policy runs.

Review and return example​

policy:
  flagged-review:
    mode: review_and_return
    provider:
      id: gpt4-reviewer
      model: your-openai-review-model
      secret_key_ref:
        env: VERDICTAN_OPENAI_REVIEW_KEY
      timeout_ms: 8000
    recursion_depth_max: 1
    provider_isolation: true
    rationale_capture: true
    prompt_template: |
      You are a safety reviewer.

      ## Input
      {input}

      ## Output
      {output}

      ## Reason
      {reason_code}

      Return ONLY valid JSON with these fields:
      {"verdict":"allow|warn|block|escalate","review_summary":"...","reviewed_response":"...","rationale":"..."}

Escalate mode example​

The escalate mode operates without a provider block. The runtime returns an escalation result immediately.

policy:
  flagged-review:
    mode: escalate
    recursion_depth_max: 1
    provider_isolation: true

Next steps​