[CNCF LFX Proposal] Kyverno: Policy Decision Log

### CNCF Project

Kyverno

### Term

2026 Term 3 (Sep-Nov)

### Program Name

Policy Decision Log

### Program Description

## Description

Kyverno's CEL engine runs a whole pipeline on the way to an admit or deny (scope filtering, match conditions, variables, validation expressions, autogen rule expansion, mutation, exception handling) and discards the per-expression detail the moment it has a final answer. When a CEL policy does something surprising (matches a resource you didn't expect, skips one you did, denies with a message that doesn't say which clause fired, or fails with a bare "no such key"), there is no supported way to see which sub-expression produced which value.

## Expected Outcomes

This feature proposes an opt-in, structured decision trace: capture what the engine already computes, once, in a stable machine-readable form, and surface it where users look (the CLI first, then reports and the running controller). It broadens KDP https://github.com/kyverno/KDP/pull/91 from a two-phase CLI-plus-runtime feature into a decision-explainability primitive for the whole CEL pipeline.

### Technologies

Kubernetes, Golang, CEL

### Skills same as Technologies?

- [x] Yes, the required skills are the same as the technologies listed above.

### Required/Desirable Skills

_No response_

### Mentors

Jim Bugwadia | @JimBugwadia | jim@nirmata.com | JimBugwadia
Jyotiraditya Panda | @rx18-eng | remopanda7@gmail.com | remolab

### Upstream Issue URL

https://github.com/kyverno/kyverno/issues/16692

### Application Prerequisites

- [x] Resume
- [x] Cover Letter
- [ ] School Enrollment Verification
- [ ] Participation Permission from school or employer
- [ ] Coding Challenge
- [x] Custom Prerequisite (fill in details below)

### Coding Challenge URL

_No response_

### Custom Prerequisite Name

Solution Video

### Custom Prerequisite Description

Create a 2-5 minute video introducing yourself and then articulating your understanding of the problem and the proposed solution. Provide a link to the video on either Google Drive or YouTube as part of your cover letter.

### Custom Prerequisite — File Upload

- [ ] Yes — completion of this task requires the mentee to submit a file.

---
**LFX program:** [CNCF - Kyverno: Policy Decision Log (2026 Term 3)](https://mentorship.lfx.linuxfoundation.org/project/e210712d-94de-4740-9ecf-201f7621425d)

Start with the upstream issue #16692 and KDP pull request #91, then trace the CEL pipeline from scope filtering through admission decisions. Define the opt-in structured trace around the values already computed, with the CLI as the first surface; done means the trace explains expression-level decisions in machine-readable form and is suitable for later reports and controller integration.

Written by the indexing model from the issue text.