RFC: Policy evaluation order — priority vs. specificity?

[VladUZH]

Working through policy engine design decisions and want outside perspective.

SidClaw evaluates policies by explicit priority ordering. If two policies match the same action, the higher-priority policy wins. Simple. Predictable. But it means you have to manually assign priorities, and conflicts are resolved by a number you set months ago and forgot about.

Alternative: specificity-based evaluation, like CSS. A policy matching agent:support-bot AND action:send-email AND recipient:*.internal beats a policy matching action:send-email because it's more specific. No manual priority needed. But the mental model is harder to debug when things go wrong.

We went with explicit priority for v0.1 because:

• Compliance teams want deterministic, auditable evaluation order
• FINRA examiners will ask "why was this action allowed?" and "because it had the highest priority number" is a clearer answer than "because CSS specificity rules"
• You can always inspect the policy list sorted by priority and trace exactly which one fired

But specificity has real advantages for complex deployments with hundreds of policies.

Anyone running a policy engine at scale? What's worked, what's been painful?