Explain Rego decision
rego_explain_decisionExplains a Rego decision by evaluating a query with full tracing, returning a structured trace and per-rule summary to answer why a policy denied or allowed.
Instructions
Evaluate a Rego query with full tracing and return a structured trace plus per-rule fired/not-fired summary. Use this when you need to answer "why was this denied?" — the agent reads the structured trace and narrates the cause without re-implementing the trace parser.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Rego query to evaluate, e.g. "data.example.allow". | |
| source | No | Inline Rego policy source. Mutually exclusive with `paths`. | |
| paths | No | Policy / data file or directory paths. Each must be inside an allowed root. | |
| input | No | Inline input document. | |
| inputPath | No | Path to a JSON input file. Mutually exclusive with `input`. | |
| unknowns | No | Refs to treat as unknown during partial evaluation. | |
| partial | No | Run partial evaluation rather than full evaluation. | |
| strictBuiltinErrors | No | Treat builtin errors as fatal instead of returning undefined. |