An agent doesn’t say which workflow it’s in. A comment on a ticket can fall under support’s rules (no passwords in tickets) and engineering’s change rules at once. Claros routes every check to the maps that govern it.

​
In order

  1. A confirmed tool mapping names its workflows (one or several, each with its own when). See Tool mapping.
  2. Otherwise, a shortlist: maps whose facts match the record’s keys, whose apps match the app, or whose words share terms with the tool’s name and description. One candidate with clear evidence is picked without a model.
  3. Otherwise one fast model call picks 0, 1 or several maps whose rules govern this kind of action.
  4. Model off or failing: the best key-overlap map with at least two signals, so a check never waits on routing.
No map matches: the action is allowed and logged as unmapped, so an editor can see it. Team rules (rules typed with Add a rule, confirmed mined rules) skip the router: every check without a pinned workflow considers them when any of them apply to its app and person.

​
Several maps

The action is checked against each map concurrently. It is allowed only if every map allows it. Each violation carries its workflow_id, and the check log gets one row per map (chk_x, chk_x.2). A stop names every map whose rule it breaks.

​
Caching

Decisions are cached per app, tool, record shape and map versions (1 hour). When the router says the decision depends on an argument’s value (depends_on), the cache keys on that value too.

​
Passing a workflow

You can still pin it: POST /v1/check with workflow_id. An unknown id is a 404.

​
Server settings

CLAROS_ROUTER=off (no model step), CLAROS_ROUTER_TIMEOUT (6 s), CLAROS_ROUTER_CACHE_TTL (3600 s).