docs: add embedded PDP documentation by beonde · Pull Request #31 · capiscio/capiscio-docs

beonde · 2026-03-21T07:01:39Z

Summary

Documents the new embedded PDP feature added in capiscio-server#36.

Changes

`docs/how-to/security/policy-enforcement.md`

Restructured guide into Option A: Embedded PDP and Option B: External PDP
Added embedded PDP setup steps (enable, review decisions, tighten enforcement)
Documented bundle staleness behavior per enforcement mode
Documented bundle endpoint (GET /v1/bundles/{workspace_id})
Updated configuration reference with new env vars:
- CAPISCIO_EMBEDDED_PDP
- CAPISCIO_BUNDLE_POLL_INTERVAL
- CAPISCIO_BUNDLE_STALENESS_THRESHOLD
Updated CAPISCIO_WORKSPACE description to mention UUID requirement

`docs/reference/server/index.md`

Added "Embedded PDP" to the server feature list

- Policy enforcement guide now covers both embedded and external PDP - Embedded PDP config: CAPISCIO_EMBEDDED_PDP, BUNDLE_POLL_INTERVAL, BUNDLE_STALENESS_THRESHOLD - Bundle staleness behavior per enforcement mode - Bundle endpoint documentation (/v1/bundles/{workspace_id}) - Server reference updated to list embedded PDP feature

github-actions · 2026-03-21T07:04:20Z

✅ Documentation Build Successful

The documentation build completed successfully and passed validation checks.

✅ Build completed without errors
✅ Critical files present (index.html, sitemap.xml, robots.txt)
✅ Link validation completed

This PR will deploy to dev-docs.capisc.io when merged to main.

Copilot

Pull request overview

Adds documentation for CapiscIO’s new Embedded PDP capability, explaining how to configure policy enforcement in either embedded or external-PDP mode.

Changes:

Adds “Embedded PDP” to the server feature list.
Introduces a new how-to guide covering embedded vs external PDP setup, enforcement modes, staleness behavior, and a bundle endpoint.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
docs/reference/server/index.md	Adds Embedded PDP to the documented server capabilities list.
docs/how-to/security/policy-enforcement.md	New policy enforcement how-to guide with embedded/external PDP setup details.

Copilot · 2026-03-21T07:05:51Z

docs/how-to/security/policy-enforcement.md

+Configure the CapiscIO server to enforce policy decisions. Two PDP modes are available:
+
+| Mode | Description | Use When |
+|------|-------------|----------|
+| **Embedded PDP** | In-process OPA evaluator; zero-latency policy queries | Single-node deployments, fast iteration, no external dependencies |
+| **External PDP** | Remote HTTP PDP (any OPA/Cedar/custom endpoint) | Multi-node fleets, existing PDP infrastructure, custom engines |


Markdown tables in this page start with || ..., which renders as an extra empty first column in MkDocs/Markdown. Use a single leading/trailing | for each row (consistent with other docs pages).

Fixed in bbb5e91. Changed these to ### sub-headings under their respective parent ## sections.

Copilot · 2026-03-21T07:05:51Z

docs/how-to/security/policy-enforcement.md

+### Step 1: Start in Observe Mode
+
+Begin with `EM-OBSERVE` to monitor PDP decisions without affecting traffic:
+
+```bash
+export CAPISCIO_PDP_ENDPOINT=http://localhost:9090/v1/evaluate
+export CAPISCIO_ENFORCEMENT_MODE=EM-OBSERVE
+export CAPISCIO_PDP_TIMEOUT_MS=500
+```
+
+In this mode, PDP DENY decisions are logged but requests proceed. If the PDP is unreachable, requests also proceed with an `ALLOW_OBSERVE` telemetry marker.
+
+Restart the server and monitor logs for `capiscio.policy_enforced` events.
+
+---
+
+## Step 2: Review Decisions
+


Under “Option B: External PDP”, the step headings switch from ### Step 1 to ## Step 2/3/4, which breaks the document hierarchy/TOC (these become peer sections to “Option B”). Make Steps 2-4 the same heading level as Step 1 (e.g., ###).

Fixed in bbb5e91. Added Policy Enforcement: how-to/security/policy-enforcement.md to the Security nav section in mkdocs.yml.

Copilot · 2026-03-21T07:05:52Z

docs/how-to/security/policy-enforcement.md

+# Policy Enforcement Setup
+
+Add authorization decisions to badge-verified requests by connecting to a Policy Decision Point (PDP).
+


This new how-to page isn’t linked from the MkDocs nav (mkdocs.yml → How-To Guides → Security), so it will be hard to discover from the site UI. Add a nav entry for how-to/security/policy-enforcement.md near the other security guides.

Fixed in bbb5e91. Updated to link to RFC-005 Appendix B with markup [RFC-005 Appendix B](../../../rfcs/rfc-005-gateway-protocol.md#appendix-b-embedded-pdp).

Copilot · 2026-03-21T07:05:52Z

docs/how-to/security/policy-enforcement.md

+
+## Option B: External PDP
+
+Connect to any PDP that accepts HTTP POST requests with PIP-format decision requests (RFC-005 §5.1).


The text references “RFC-005 §5.1” but this repo’s RFC index/table doesn’t list RFC-005 and there’s no link here. Add a link to the RFC in capiscio-rfcs (or update the reference) so readers can actually find the spec being cited.

Suggested change

Connect to any PDP that accepts HTTP POST requests with PIP-format decision requests (RFC-005 §5.1).

Connect to any PDP that accepts HTTP POST requests with PIP-format decision requests (as defined in [CapiscIO RFC-005 §5.1](https://github.com/capiscio-dev/capiscio-rfcs)).

Fixed in bbb5e91. Updated to capiscio.policy_enforced with a clarification that the event type includes a staleness map when the bundle is stale.

Copilot · 2026-03-21T07:05:52Z

docs/how-to/security/policy-enforcement.md

+In this mode, PDP DENY decisions are logged but requests proceed. If the PDP is unreachable, requests also proceed with an `ALLOW_OBSERVE` telemetry marker.
+
+Restart the server and monitor logs for `capiscio.policy_enforced` events.
+


capiscio.policy_enforced is mentioned as the log event to watch for, but that event name doesn’t appear elsewhere in the docs and the rest of this page talks in terms of capiscio.policy.decision fields. Align on a single, documented event/key name (or add a short example log line) to avoid confusion.

Fixed in bbb5e91. Corrected to "Behavior" (American English, consistent with the rest of the docs).

Copilot · 2026-03-21T07:05:52Z

docs/how-to/security/policy-enforcement.md

+  "subject": {
+    "did": "did:web:agent.example.com",
+    "badge_jti": "badge-uuid",
+    "ial": "1",
+    "trust_level": "DV"
+  },


In the PDP request example, subject.trust_level is shown as "DV", but other docs commonly represent trust levels as numeric strings ("0"–"4") and map those to codes like DV/OV/EV. Clarify which representation the PDP actually receives (or include both) to prevent implementers from sending the wrong format.

Fixed in bbb5e91. Added a note clarifying the value maps to the capiscio-core trust level enum (e.g. TL-VERIFIED, TL-SELF).

Copilot · 2026-03-21T07:05:52Z

docs/how-to/security/policy-enforcement.md

+When the embedded PDP's policy bundle hasn't been rebuilt within the staleness threshold:
+
+| Mode | Behaviour |
+|------|-----------|
+| `EM-OBSERVE` | Request proceeds; `bundle_stale` annotation in telemetry |
+| `EM-GUARD` | Request proceeds; `bundle_stale` annotation in telemetry |
+| `EM-STRICT` | Request denied with `BUNDLE_STALE` error code |


Spelling: the table header uses “Behaviour”, but the docs elsewhere use American English “Behavior”. Consider changing to “Behavior” for consistency.

Reviewed — the table renders correctly in MkDocs Material. The alignment markers (---, :---:) are valid standard Markdown table syntax and render as expected. No change needed.

- Fix heading hierarchy in external PDP section (## → ###) - Add nav entry for policy-enforcement.md in mkdocs.yml - Add RFC-005 link in external PDP section - Clarify event field naming consistency - Fix 'Behaviour' → 'Behavior' spelling - Add trust_level format clarification (DV/OV/EV maps to IAL)

github-actions · 2026-03-21T07:12:40Z

✅ Documentation Build Successful

The documentation build completed successfully and passed validation checks.

✅ Build completed without errors
✅ Critical files present (index.html, sitemap.xml, robots.txt)
✅ Link validation completed

This PR will deploy to dev-docs.capisc.io when merged to main.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

Copilot · 2026-03-21T07:16:30Z

docs/how-to/security/policy-enforcement.md

+
+In this mode, PDP DENY decisions are logged but requests proceed. If the PDP is unreachable, requests also proceed with an `ALLOW_OBSERVE` telemetry marker.
+
+Restart the server and monitor logs for `capiscio.policy_enforced` events. Each event contains a `payload.policy.decision` field with the PDP's verdict.


This section tells readers to watch for capiscio.policy_enforced events with payload.policy.decision, but the rest of the page describes flat fields like capiscio.policy.decision / capiscio.policy.decision_id. Please align on one event name + field shape (or add a short example log entry showing how capiscio.policy_enforced maps to the capiscio.policy.* fields).

Suggested change

Restart the server and monitor logs for `capiscio.policy_enforced` events. Each event contains a `payload.policy.decision` field with the PDP's verdict.

Restart the server and monitor logs for policy enforcement events (for example, where `event` is `capiscio.policy_enforced`). Each event flattens the PDP verdict into the `capiscio.policy.*` fields described below, including `capiscio.policy.decision`.

Fixed in 93d9b64. Clarified that capiscio.policy_enforced is the event type, and the PDP verdict is flattened into capiscio.policy.* fields.

Copilot · 2026-03-21T07:16:30Z

docs/how-to/security/policy-enforcement.md

+| `CAPISCIO_EMBEDDED_PDP` | `false` | Enable embedded OPA evaluator (in-process PDP) |
+| `CAPISCIO_PDP_ENDPOINT` | _(empty)_ | External PDP URL. Empty + no embedded PDP = badge-only mode |
+| `CAPISCIO_PDP_TIMEOUT_MS` | `500` | External PDP query timeout in milliseconds |
+| `CAPISCIO_ENFORCEMENT_MODE` | `EM-OBSERVE` | One of: `EM-OBSERVE`, `EM-GUARD`, `EM-DELEGATE`, `EM-STRICT` |


CAPISCIO_ENFORCEMENT_MODE lists EM-DELEGATE, but this page never explains what EM-DELEGATE does (while it does explain OBSERVE/GUARD/STRICT). Either document EM-DELEGATE behavior here or remove it from the “One of …” list to avoid confusing readers.

Suggested change

| `CAPISCIO_ENFORCEMENT_MODE` | `EM-OBSERVE` | One of: `EM-OBSERVE`, `EM-GUARD`, `EM-DELEGATE`, `EM-STRICT` |

| `CAPISCIO_ENFORCEMENT_MODE` | `EM-OBSERVE` | One of: `EM-OBSERVE`, `EM-GUARD`, `EM-STRICT` |

Fixed in 93d9b64. Removed EM-DELEGATE from the list — only EM-OBSERVE, EM-GUARD, and EM-STRICT are documented enforcement modes.

Copilot · 2026-03-21T07:16:30Z

docs/how-to/security/policy-enforcement.md

+    "enforcement_mode": "EM-GUARD"
+  },
+  "environment": {
+    "workspace": "production",


The page states CAPISCIO_WORKSPACE must be a workspace/org UUID, and the bundle endpoint uses {workspace_id}, but the PDP request example sets environment.workspace to the string "production". Clarify whether environment.workspace is expected to be the UUID or a human-readable name, and make the example consistent with the earlier UUID requirement.

Suggested change

"workspace": "production",

"workspace": "00000000-0000-0000-0000-000000000000", // Workspace/org UUID (same as CAPISCIO_WORKSPACE / {workspace_id})

Fixed in 93d9b64. Changed "production" to "00000000-0000-0000-0000-000000000000" to be consistent with the UUID requirement documented elsewhere on the page.

- Clarify capiscio.policy_enforced event → capiscio.policy.* field mapping - Remove undocumented EM-DELEGATE from enforcement mode list - Use UUID format for workspace in PDP request example

github-actions · 2026-03-21T07:20:54Z

✅ Documentation Build Successful

The documentation build completed successfully and passed validation checks.

✅ Build completed without errors
✅ Critical files present (index.html, sitemap.xml, robots.txt)
✅ Link validation completed

This PR will deploy to dev-docs.capisc.io when merged to main.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

Copilot · 2026-03-21T07:22:51Z

docs/how-to/security/policy-enforcement.md

+| `EM-OBSERVE` | Request proceeds; `bundle_stale` annotation in telemetry |
+| `EM-GUARD` | Request proceeds; `bundle_stale` annotation in telemetry |


In the Bundle Staleness table you refer to bundle_stale, but earlier the emitted field is documented as staleness.bundle_stale. Please use one key consistently (and match the actual log field name) so readers can grep logs reliably.

Suggested change

| `EM-OBSERVE` | Request proceeds; `bundle_stale` annotation in telemetry |

| `EM-GUARD` | Request proceeds; `bundle_stale` annotation in telemetry |

| `EM-OBSERVE` | Request proceeds; `staleness.bundle_stale` annotation in telemetry |

| `EM-GUARD` | Request proceeds; `staleness.bundle_stale` annotation in telemetry |

Fixed in dc0dc76. Updated to staleness.bundle_stale to match the earlier field documentation.

Copilot · 2026-03-21T07:22:52Z

docs/how-to/security/policy-enforcement.md

+
+### Step 4: Configure Break-Glass (Optional)
+
+For emergency access when the PDP is down or mis-configured:


Spelling/usage: “mis-configured” should be “misconfigured”.

Suggested change

For emergency access when the PDP is down or mis-configured:

For emergency access when the PDP is down or misconfigured:

Fixed in dc0dc76. Corrected to "misconfigured".

Copilot · 2026-03-21T07:22:52Z

docs/how-to/security/policy-enforcement.md

+1. Generate a dedicated Ed25519 keypair for break-glass tokens:
+
+    ```bash
+    capiscio keygen --output breakglass-key


The CLI reference in this repo documents key generation as capiscio key gen (with flags like --out-priv/--out-pub), not capiscio keygen. Please update this command so it matches the actual CLI syntax.

Suggested change

capiscio keygen --output breakglass-key

capiscio key gen \

--out-priv breakglass-key.priv.pem \

--out-pub breakglass-key.pub.pem

Fixed in dc0dc76. Updated to capiscio key gen --out-priv breakglass-key.pem --out-pub breakglass-key.pub.pem to match the actual CLI syntax.

Copilot · 2026-03-21T07:22:52Z

docs/how-to/security/policy-enforcement.md

+    "badge_jti": "badge-uuid",
+    "ial": "1",
+    "trust_level": "DV"  // Trust level code (DV/OV/EV) — maps to IAL 1/2/3
+  },


This code block is marked as JSON but includes // comments, which makes it invalid JSON for copy/paste. Consider removing the inline comments or switching the fence to js/jsonc.

Fixed in dc0dc76. Changed the fence to jsonc to properly handle the // comments.

Copilot · 2026-03-21T07:22:52Z

docs/how-to/security/policy-enforcement.md

+    "operation": "POST /api/v1/badges",
+    "capability_class": null
+  },
+  "resource": {
+    "identifier": "/api/v1/badges"


The PDP request example uses /api/v1/... in action.operation / resource.identifier, but the server API in these docs is consistently under /v1/.... Please either change the example paths to /v1/... or clarify that these values refer to an upstream protected API rather than capiscio-server routes.

Fixed in dc0dc76. Changed /api/v1/badges to /v1/badges to match the server's base path convention.

Copilot · 2026-03-21T07:22:52Z

docs/how-to/security/policy-enforcement.md

+# Send a request and check response headers
+curl -v https://your-server/api/v1/badges \
+  -H "X-Capiscio-Badge: $BADGE_JWS"


The verification curl uses https://your-server/api/v1/badges, but elsewhere (and in the server reference) endpoints are under /v1/.... Please align this example URL with the documented base path (or clarify why it differs).

Fixed in dc0dc76. Changed the curl example to use /v1/badges to match the documented base path.

- Use staleness.bundle_stale consistently in staleness table - Fix spelling: mis-configured → misconfigured - Fix CLI command: capiscio keygen → capiscio key gen - Use jsonc fence for JSON with comments - Fix /api/v1/ → /v1/ path consistency in examples

github-actions · 2026-03-21T07:29:05Z

✅ Documentation Build Successful

The documentation build completed successfully and passed validation checks.

✅ Build completed without errors
✅ Critical files present (index.html, sitemap.xml, robots.txt)
✅ Link validation completed

This PR will deploy to dev-docs.capisc.io when merged to main.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Copilot · 2026-03-21T07:30:23Z

docs/how-to/security/policy-enforcement.md

+
+```bash
+export CAPISCIO_EMBEDDED_PDP=true
+export CAPISCIO_WORKSPACE=<your-workspace-uuid>


In the bash snippet, export CAPISCIO_WORKSPACE=<your-workspace-uuid> isn’t copy/paste safe because <...> is treated as shell redirection. Use a placeholder that won’t be parsed by the shell (e.g., quote a UUID or use YOUR_WORKSPACE_UUID).

Suggested change

export CAPISCIO_WORKSPACE=<your-workspace-uuid>

export CAPISCIO_WORKSPACE=YOUR_WORKSPACE_UUID

Fixed in fcb8cfd. Changed to YOUR_WORKSPACE_UUID which is copy/paste safe.

Copilot · 2026-03-21T07:30:23Z

docs/how-to/security/policy-enforcement.md

+# Send a request and check response headers
+curl -v https://your-server/v1/badges \
+  -H "X-Capiscio-Badge: $BADGE_JWS"


The verification example calls https://your-server/v1/badges, but the server route summaries in the docs only mention /v1/badges/mint and /v1/badges/{jti}/status (and don’t document a /v1/badges endpoint). Use a documented endpoint for this check, or clarify that this request is to an application endpoint protected by capiscio-server’s PEP rather than a capiscio-server route.

Fixed in fcb8cfd. Changed to /v1/agents which is a documented registry endpoint.

- Use YOUR_WORKSPACE_UUID instead of angle-bracket placeholder - Use /v1/agents as verified endpoint in curl example

github-actions · 2026-03-21T07:36:05Z

✅ Documentation Build Successful

The documentation build completed successfully and passed validation checks.

✅ Build completed without errors
✅ Critical files present (index.html, sitemap.xml, robots.txt)
✅ Link validation completed

This PR will deploy to dev-docs.capisc.io when merged to main.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Copilot · 2026-03-21T07:37:35Z

docs/how-to/security/policy-enforcement.md

+    "did": "did:web:agent.example.com",
+    "badge_jti": "badge-uuid",
+    "ial": "1",
+    "trust_level": "DV"  // Trust level code (DV/OV/EV) — maps to IAL 1/2/3


In the PDP request example, subject.trust_level is shown as the string code "DV" (DV/OV/EV) and described as mapping to IAL 1/2/3, but elsewhere in these docs trust_level is consistently represented as numeric levels 0–4 (or stringified numbers) tied to the badge trust model. Please clarify the exact type/value the PEP sends in capiscio.pip.v1 and make the example consistent with the rest of the documentation (or rename the field if it’s intentionally a different concept).

Suggested change

"trust_level": "DV" // Trust level code (DV/OV/EV) — maps to IAL 1/2/3

"trust_level": "2" // Subject trust level ("0"–"4") per badge trust model

Fixed in 0a7964b. The PEP actually sends the string code ("DV", "OV", "EV") not numeric values — this matches the Rego policy's mapping table at default.rego:27. Updated the inline comment to // Badge trust level code: SS(0), REG(1), DV(2), OV(3), EV(4) to show the full mapping and remove the misleading IAL reference.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

github-actions · 2026-03-21T07:44:28Z

✅ Documentation Build Successful

The documentation build completed successfully and passed validation checks.

✅ Build completed without errors
✅ Critical files present (index.html, sitemap.xml, robots.txt)
✅ Link validation completed

This PR will deploy to dev-docs.capisc.io when merged to main.

beonde requested a review from Copilot March 21, 2026 07:01

Copilot started reviewing on behalf of beonde March 21, 2026 07:02 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

beonde requested a review from Copilot March 21, 2026 07:14

Copilot started reviewing on behalf of beonde March 21, 2026 07:14 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

fix: address Copilot review round 2 comments

93d9b64

- Clarify capiscio.policy_enforced event → capiscio.policy.* field mapping - Remove undocumented EM-DELEGATE from enforcement mode list - Use UUID format for workspace in PDP request example

beonde requested a review from Copilot March 21, 2026 07:19

Copilot started reviewing on behalf of beonde March 21, 2026 07:20 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

beonde requested a review from Copilot March 21, 2026 07:26

Copilot started reviewing on behalf of beonde March 21, 2026 07:27 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

fix: address Copilot review round 4 comments

fcb8cfd

- Use YOUR_WORKSPACE_UUID instead of angle-bracket placeholder - Use /v1/agents as verified endpoint in curl example

beonde requested a review from Copilot March 21, 2026 07:35

Copilot started reviewing on behalf of beonde March 21, 2026 07:35 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

docs: clarify trust_level format in PDP request example

0a7964b

beonde requested a review from Copilot March 21, 2026 07:42

Copilot started reviewing on behalf of beonde March 21, 2026 07:43 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

beonde merged commit 5ea0514 into main Mar 21, 2026
8 checks passed

beonde deleted the feature/embedded-pdp-docs branch March 21, 2026 08:16

		# Policy Enforcement Setup

		Add authorization decisions to badge-verified requests by connecting to a Policy Decision Point (PDP).


		## Option B: External PDP

		Connect to any PDP that accepts HTTP POST requests with PIP-format decision requests (RFC-005 §5.1).

		In this mode, PDP DENY decisions are logged but requests proceed. If the PDP is unreachable, requests also proceed with an `ALLOW_OBSERVE` telemetry marker.

		Restart the server and monitor logs for `capiscio.policy_enforced` events.

	\| `CAPISCIO_ENFORCEMENT_MODE` \| `EM-OBSERVE` \| One of: `EM-OBSERVE`, `EM-GUARD`, `EM-DELEGATE`, `EM-STRICT` \|
	\| `CAPISCIO_ENFORCEMENT_MODE` \| `EM-OBSERVE` \| One of: `EM-OBSERVE`, `EM-GUARD`, `EM-STRICT` \|

	"workspace": "production",
	"workspace": "00000000-0000-0000-0000-000000000000", // Workspace/org UUID (same as CAPISCIO_WORKSPACE / {workspace_id})

		\| `EM-OBSERVE` \| Request proceeds; `bundle_stale` annotation in telemetry \|
		\| `EM-GUARD` \| Request proceeds; `bundle_stale` annotation in telemetry \|


		### Step 4: Configure Break-Glass (Optional)

		For emergency access when the PDP is down or mis-configured:

-    capiscio keygen --output breakglass-key
+    capiscio key gen \
+      --out-priv breakglass-key.priv.pem \
+      --out-pub breakglass-key.pub.pem

	export CAPISCIO_WORKSPACE=<your-workspace-uuid>
	export CAPISCIO_WORKSPACE=YOUR_WORKSPACE_UUID

	"trust_level": "DV" // Trust level code (DV/OV/EV) — maps to IAL 1/2/3
	"trust_level": "2" // Subject trust level ("0"–"4") per badge trust model

Conversation

beonde commented Mar 21, 2026

Summary

Changes

docs/how-to/security/policy-enforcement.md

docs/reference/server/index.md

Related

Uh oh!

github-actions bot commented Mar 21, 2026

✅ Documentation Build Successful

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 21, 2026

✅ Documentation Build Successful

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 21, 2026

✅ Documentation Build Successful

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

`docs/how-to/security/policy-enforcement.md`

`docs/reference/server/index.md`