Flagged Review Configuration

flagged-review is an output-phase policy that can hand borderline content to a secondary reviewer, request a safe rewritten response, or immediately emit an escalation verdict.

Supported config shape

policies:
  chain:
    - prompt-injection
    - flagged-review
    - audit-logger

policy:
  prompt-injection:
    embedding_threshold: 0.6
    response:
      action: block

  flagged-review:
    mode: judge
    provider:
      name: review-llm
      endpoint: https://api.openai.com/v1/chat/completions
      model: gpt-5.4-mini
      secret_key_ref:
        env: KEEPTRUSTS_OPENAI_REVIEW_KEY
      timeout_ms: 5000
    recursion_depth_max: 1
    provider_isolation: true
    rationale_capture: true

Modes

Mode	Runtime behavior
`judge`	Calls the review provider and expects a structured verdict
`review_and_return`	Calls the review provider and requires `reviewed_response` when verdict is `allow` or `warn`
`audit_only`	Calls the review provider for audit telemetry, without changing the returned response
`escalate`	Returns an immediate escalation result; it does not need to call a review provider

Field reference

Field	Type	Default	Notes
`mode`	string	`judge`	`judge`, `review_and_return`, `audit_only`, `escalate`
`provider.name` / `provider.id`	string	mode-dependent	`name` or `id` are accepted; defaults to `flagged-review`, or `human_escalation` in `escalate` mode
`provider.endpoint`	string	`https://api.openai.com/v1/chat/completions`	Used for provider-backed modes
`provider.model`	string	`gpt-5.4-mini`	Defaults to `manual_review` in `escalate` mode
`provider.secret_key_ref`	object	—	`env` only on this surface; `store` is rejected
`provider.timeout_ms`	integer	`5000`	Used for provider-backed modes
`recursion_depth_max`	integer	`1`	Values below `1` are coerced up to `1`; no hard max is enforced during config validation
`provider_isolation`	boolean	`true`	Fails review if it reuses the same provider/endpoint as the primary path
`rationale_capture`	boolean	`true`	Controls whether `rationale` is captured from the reviewer payload
`prompt_template`	string	built-in	Supports `{input}`, `{output}`, `{reason_code}`, `{mode}` placeholders

Structured reviewer response

For provider-backed modes, the reviewer response must be JSON with these fields:

verdict: allow, warn, block, or escalate
review_summary: short operator-facing summary
rationale: short explanation (used when rationale_capture: true)
reviewed_response: required for review_and_return when verdict is allow or warn

Use verdict; decision is not a supported reviewer response field.

Example: review-and-return

policy:
  flagged-review:
    mode: review_and_return
    provider:
      id: gpt4-reviewer
      model: gpt-5.4-mini
      secret_key_ref:
        env: KEEPTRUSTS_OPENAI_REVIEW_KEY
      timeout_ms: 8000
    recursion_depth_max: 1
    provider_isolation: true
    rationale_capture: true
    prompt_template: |
      You are a safety reviewer.

      ## Input
      {input}

      ## Output
      {output}

      ## Reason
      {reason_code}

      Return ONLY valid JSON with these fields:
      {"verdict":"allow|warn|block|escalate","review_summary":"...","reviewed_response":"...","rationale":"..."}

Example: escalate mode

escalate mode can omit the provider block entirely because the runtime returns an escalation result immediately.

policy:
  flagged-review:
    mode: escalate
    recursion_depth_max: 1
    provider_isolation: true

Supported config shape​

Modes​

Field reference​

Structured reviewer response​

Example: review-and-return​

Example: escalate mode​

Next steps​