Nothing to try yetTier: how much it should matter to you
3Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
ComplianceArea: what it touches
In DevelopmentKind: in v2.1.277,
What probably matters to youSection of the release
Unclear Which specific compliance keys or actions this exception applies to is not stated
What
Org-policy compliance checks now have a fail-open path for when the system that decides compliance verdicts is unreachable:
A new failOpenVerdict boolean is tracked in the session's policy-limits cache and updated whenever replaceSessionCache or hint updates run.
The cache also emits a new heldStartSignal on every emitVerdictChanged() call, separate from the verdict-changed signal itself.
When the verdict service is unreachable and the identity that settled without a verdict matches the current principal, certain otherwise-denied compliance keys (such as HIPAA-related ones) become allowed again, unless the required HIPAA evidence hasn't been loaded or can't be read.
Why
This prevents a temporarily unreachable compliance-verdict service from blocking users outright, while still requiring the right evidence to be present before allowing HIPAA-related actions through the fail-open path.
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtWhich specific compliance keys or actions this exception applies to is not stated
