Explain Rego decision
rego_explain_decisionEvaluate a Rego query with full tracing to explain why a decision was made, providing a structured trace and per-rule fired/not-fired summary.
Instructions
Evaluate a Rego query with full tracing and return a structured trace plus per-rule fired/not-fired summary. Use this when you need to answer "why was this denied?" -- the agent reads the structured trace and narrates the cause without re-implementing the trace parser.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Rego query to evaluate, e.g. "data.example.allow". | |
| source | No | Inline Rego policy source. Mutually exclusive with `paths`. | |
| paths | No | Policy / data file or directory paths. Each must be inside an allowed root. | |
| input | No | Inline input document. | |
| inputPath | No | Path to a JSON input file. Mutually exclusive with `input`. | |
| unknowns | No | Refs to treat as unknown during partial evaluation. | |
| partial | No | Run partial evaluation rather than full evaluation. | |
| strictBuiltinErrors | No | Treat builtin errors as fatal instead of returning undefined. |