Operations

Every /v1/decide call is fail-closed for the decision itself and fail-open for telemetry: a broken or unreachable observability sink never blocks a decision, and a broken or ambiguous policy never opens one.

• SIEM export — the structured syslog event Reeflex can emit for every decision (JSON or CEF), the severity map, and worked configuration examples for Splunk, QRadar, Wazuh, FortiSIEM, Graylog, Loki, Datadog, Logstash, Filebeat, Fluentd, and Kafka.