RFC: centralized policy framework with PolicyDecisionEvent

**Context:** ROADMAP.md → Centralized policy framework
**Related:** #230 (event-driven governance), Cedar HITL (shipped)

---

## Primary area

Cross-cutting / multiple

## Related issue or feature request

#230 (Event-Driven Governance and Actions), shipped Cedar HITL gates

## Summary

Unified **Cedar-based policy framework** with `PolicyDecisionEvent` audit schema. Three enforcement modes with **observe-before-enforce** rollout across tool calls, lifecycle events, and future event-driven governance.

## Use case and motivation

Policy decisions today are fragmented (PreToolUse Cedar, guardrails, bash allowlists). Compliance needs a single auditable decision stream and consistent observe/enforce rollout.

## Proposal

1. Define `PolicyDecisionEvent` schema: `decision`, `policy_id`, `matching_rule_ids`, `context`, `task_id`, timestamp.
2. Emit on every Cedar evaluation + lifecycle policy hook (#230).
3. Modes: `observe`, `enforce`, `disabled` per policy pack.
4. Export to immutable audit (#237) when available.
5. Operator dashboard: deny rates by repo/policy.

## Out of scope

- Replacing Bedrock Guardrails (input/output screening stays separate).
- Full implementation of all #230 semantic gates in v1.

## Potential challenges

- cedarpy/cedar-wasm parity (see AGENTS.md cedar pin rules).
- Volume of decision events at high task throughput.
- Migration from current HITL-only audit shape.

## Dependencies and integrations

- `TaskEventsTable`, FanOutConsumer, #230 RFC.
- `docs/design/CEDAR_HITL_GATES.md`.

## Alternative solutions

- Extend current HITL audit only—less unified for non-tool policies.
- OPA/Cedar split—rejected for dual engine maintenance.

---

**Note:** Non-triaged RFCs may not get timely review.

- RFC PR:
- Approved by:
- Reviewed by:

Read ROADMAP.md at the Centralized policy framework entry and docs/design/CEDAR_HITL_GATES.md first, then review the TaskEventsTable and FanOutConsumer references. The proposal spans Cedar evaluation, lifecycle hooks, rollout modes, audit export, and a dashboard; done requires a reviewed and approved scope, with the RFC fields no longer blank.

Written by the indexing model from the issue text.