Decionis Node.js SDK

Decionis is the Enterprise Decision Protocol for policy-enforced automation and verifiable audit trails.

The Node.js SDK provides execution interceptors for APIs, bots, and workflow services. It captures execution intent, submits it to Decionis, and continues, stops, or hands off based on the signed decision.

Installation

npm install @decionis-ai/sdk

API Key

Set DECIONIS_API_KEY in your server-side runtime. Get a key by subscribing at https://decionis.com or by requesting an API key from Decionis. API-key registration can include an industry such as financial_services, healthcare, retail, or technology; Decionis can provision a default encoded policy binding for that industry in shadow mode.

Quickstart

import { DecionisClient } from "@decionis-ai/sdk";

const decionis = new DecionisClient({
  apiKey: process.env.DECIONIS_API_KEY!,
  baseUrl: "https://api.decionis.com",
  tenantId: "bank_001",
});

async function executeTransfer() {
  return { submitted: true };
}

const execution = await decionis.enforce(
  {
    actor: { id: "agent_42", type: "AI_AGENT" },
    action: { type: "TRANSFER_FUNDS", resource: "liquidity_pool" },
    context: { workflow: "treasury_ops", environment: "production" },
    policyRefs: ["treasury-transfer-policy-v3"],
    idempotencyKey: "txn_<unique_execution_id>",
  },
  {
    execute: async () => executeTransfer(),
  },
);

const decision = execution.decision;
const dossier = await decionis.createDossier(decision.decisionId);
const health = await decionis.ping();

console.log(decision.status);
console.log(decision.dossierUrl);
console.log(dossier);
console.log(health);

Use one idempotency key per execution intent. Reusing the same key returns the same Decionis decision replay instead of creating a new governed decision record.

Use evaluate for decision-only diagnostics, simulations, or pre-flight observability:

const decision = await decionis.evaluate({
  actor: { id: "agent_42", type: "AI_AGENT" },
  action: { type: "TRANSFER_FUNDS", resource: "liquidity_pool" },
  context: { workflow: "treasury_ops", environment: "production" },
  policyRefs: ["treasury-transfer-policy-v3"],
  idempotencyKey: "txn_<unique_execution_id>",
});

Fastify / Express Interceptor

fastify.post(
  "/orders",
  {
    preHandler: decionis.interceptor({
      action: "OPEN_POSITION",
      policy: "cfd-risk-policy",
      actor: { id: "cfd_bot_7", type: "TRADING_BOT" },
    }),
  },
  async (request) => {
    return broker.openPosition(request.body);
  },
);

Route Guard

app.post(
  "/transfers",
  decionis.guard({
    action: "TRANSFER_FUNDS",
    policy: "treasury-transfer-policy-v3",
    actor: { id: "treasury-agent", type: "AI_AGENT" },
  }),
  async (request, response) => {
    response.json(await paymentService.transfer(request.body));
  },
);

Enforcement

Use enforce when the SDK should fail closed for non-allowed decisions before the execution callback runs:

await decionis.enforce(
  {
    actor: { id: "checkout-worker", type: "SERVICE" },
    action: { type: "CAPTURE_PAYMENT", resource: "order_9812" },
    context: { surface: "shopify", channel: "checkout" },
    policyRefs: ["commerce-integrity-policy-v1"],
  },
  {
    execute: () => paymentGateway.capture("order_9812"),
  },
);

Decision-only enforce(request) remains available during the 0.x transition, but it is deprecated. Use evaluate(request) for diagnostics and bound enforce(request, { execute }) for production gates.

const shadowExecution = await decionis.enforce(request, {
  shadow: true,
  execute: () => strategy.run(),
});

Policy Encoding

Most applications should not call policy encoding. Use it only from an internal policy authoring or deployment pipeline that already has a reviewed Decionis policy bundle artifact. The SDK forwards that artifact to Decionis and returns the accepted artifact metadata; it does not evaluate policy rules locally.

const encoding = await decionis.encodePolicy(
  {
    protocolVersion: "1.0",
    bundleId: "018f4e6a-64d1-7b31-91ac-42d6db8a0001",
    orgId: "trading_client_001",
    version: "cfd-risk-policy@2026-05-03",
    effectiveFrom: "2026-05-03T00:00:00Z",
    rules: [{ artifact_ref: "decionis-admin-export:policy-rule-001" }],
    metadata: { source: "decionis-admin-export" },
  },
  { idempotencyKey: "policy-bundle-001" },
);

console.log(encoding.artifactId);

The package publishes ESM and CJS builds with npm provenance.