Decionis
Decionis Docs
Base URL: https://api.decionis.com/v1
QuickstartMain siteContact
API documentation

Vertex go-live checklist

Use this page when a partner is moving from a successful Vertex adapter test into a live governed workflow. The goal is simple: keep Vertex as the distribution and reasoning surface while Decionis Protocol remains the execution-time decision boundary.

Readiness

These are the minimum conditions to consider a Vertex integration ready for controlled production traffic.

AreaRequirementGo-live signal
CredentialsA Decionis org API key with decision:write, decision:*, or org:* scope is issued for the target workspace.The adapter route returns 200 for a valid direct verification call.
Policy boundaryThe intended policy version and workflow key are already active in Decionis.The response shows the expected policy_version and execution_guidance.
ProofDecision Dossier verification is enabled and reachable.verification.verification_url resolves for the returned dossier.
IdentityGoogle edge identity verification is either intentionally disabled or correctly configured.google_identity_mode and google_identity_verified match the expected deployment posture.
RegionAllowed locations and serving region are explicitly configured when locality matters.regional_posture shows location_accepted=true for valid requests.
ObservabilityLog metrics, dashboard, and baseline alerts exist in Google Cloud.Cloud Monitoring resources are present and begin receiving live data.
Go-live boundary

Do not treat a green tool import alone as production readiness. The real go-live signal is a successful adapter call that produces a dossier, metering record, and downstream behavior that obeys execution_guidance.

Runtime config

Use these settings to make the adapter posture explicit before live traffic begins.

Vertex adapter env

These settings control Google edge identity, location posture, and usage export.

GOOGLE_CLOUD_VERTEX_OIDC_AUDIENCES=
GOOGLE_CLOUD_VERTEX_OIDC_ISSUERS=
GOOGLE_CLOUD_VERTEX_OIDC_HEADER_NAME=x-google-identity-token
GOOGLE_CLOUD_VERTEX_ALLOWED_LOCATIONS=
GOOGLE_CLOUD_VERTEX_LOCATION_REQUIRED=0
GOOGLE_CLOUD_VERTEX_SERVING_REGION=
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_ENABLED=0
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_SERVICE_NAME=
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_METRIC_NAME=decionis.googleapis.com/verified_decision
GOOGLE_CLOUD_VERTEX_SERVICE_CONTROL_OPERATION_NAME=decionis.vertex.extensions.verify

Reference docs

Keep the implementation page and the API contract close at hand during rollout.

NeedPath
Vertex implementationhttps://docs.decionis.com/vertex-ai-extension
API overviewhttps://docs.decionis.com/api
Decision Dossierhttps://docs.decionis.com/decision-dossier
Validation Packshttps://docs.decionis.com/validation-packs

Execution checks

Run these checks in order so failures stay isolated and easy to diagnose.

# 1. Direct adapter check
curl -X POST https://api.decionis.com/v1/google-cloud/vertex/extensions/verify \
  -H "Authorization: Bearer dcy_org_xxx" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: vertex-go-live-1" \
  -d '{
    "org_id": "<org_uuid>",
    "decision_type": "TRANSACTION_ROUTING",
    "workflow_key": "finance_transaction_routing",
    "system_of_record": "SAP",
    "intent": {
      "action_type": "CREATE_VENDOR_PAYMENT",
      "target_entity": "invoice",
      "target_id": "INV-2048",
      "payload": {
        "invoice_id": "INV-2048",
        "currency": "EUR"
      }
    },
    "google_context": {
      "project_id": "your-gcp-project",
      "location": "europe-west1",
      "agent_id": "vertex-agent-1"
    }
  }'

# 2. Inspect the response for:
#    status
#    policy_version
#    verification
#    google_identity_verified
#    regional_posture
#    metering
#    metering_export
#    execution_guidance

# 3. Replay the same request with the same Idempotency-Key
#    Expect stable governed output, not a second uncontrolled action

# 4. List recorded Vertex metering events
curl -H "Authorization: Bearer dcy_org_xxx" \
  https://api.decionis.com/v1/orgs/<org_id>/google-cloud/vertex/metering

# 5. If Service Control export is enabled and a prior export failed,
#    replay the export without rerunning the business decision
curl -X POST -H "Authorization: Bearer dcy_org_xxx" \
  https://api.decionis.com/v1/orgs/<org_id>/google-cloud/vertex/metering/<event_id>/replay-service-control
CheckExpected result
Direct adapter callHTTP 200 with a governed verdict and dossier proof.
Idempotent replaySame outcome with replay-safe behavior.
Dossier verificationPublic verification URL resolves cleanly.
Execution gatingDownstream step only runs when execution_guidance.allowed is true.
Metering ledgerA verified_decision event exists for the call.

Google-native checks

These checks prove the Google-facing posture is working, not just the core Decionis decision route.

SurfaceValidationHealthy signal
Identity validationSend one valid request and one invalid or missing-token request when OIDC is required.Valid request returns google_identity_verified=true. Invalid request returns 401.
Regional enforcementCall once with an allowed location and once with a disallowed one when allowlisting is active.Allowed request succeeds. Disallowed request returns 400.
Cloud LoggingInspect adapter logs after a live verification call.Logs include project, location, subject or service account, verdict, trace data, and metering labels.
Cloud Monitoring metricsCheck the Vertex log metrics after traffic reaches the adapter.Verified, blocked, hold, and invalid-identity/location metrics exist and receive data.
DashboardOpen the Decionis Vertex Extension dashboard in Cloud Monitoring.The dashboard loads and shows the live metric series.
AlertsReview the baseline alert policies for invalid identity/location, blocked surge, and hold surge.Policies exist and are attached to the expected project.

Rollback

A controlled rollback should reduce risk without removing evidence or breaking downstream verification.

SituationRollback actionKeep in place
Identity verification causes false negativesSwitch from required to optional while investigating token audience or issuer problems.Decision Dossiers, metering ledger, and execution_guidance enforcement.
Regional posture rejects valid trafficWiden the allowlist or temporarily disable required location checks.Serving region reporting and verification proof.
Service Control export failsDisable export or leave it best-effort and use replay later.The governed decision path and the Decionis metering ledger.
Vertex tool behavior is unstableFall back to direct adapter invocation from the calling service or queue.The Decionis adapter contract and Protocol execution authority.

Reference assets

Use these files as the starting point for implementation and rollout.

OpenAPI spec

Import or mirror this artifact into the Google-controlled environment you use for Vertex tooling.

https://docs.decionis.com/openapi/decionis-vertex-extension-v1.yaml

Tool bundle

Use this metadata wrapper when a partner needs the operation list, docs links, scope expectations, and downstream authority posture in one file.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-authority-tool-bundle.json

Reference flow

Use this compact JSON flow to validate observational evaluation, canonical authority, pre-commit claim, override, and drift behavior without adding policy logic to Vertex.

https://docs.decionis.com/examples/decionis-vertex-reference-flow.json

Agent Card

Upload this standalone Agent Card JSON to Cloud Storage in the marketplace project and validate it in Producer Portal.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-agent-card.json

A2A discovery profile

Use this profile when agent-discovery catalogs need a clear Decionis authority card before a full integration run.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-a2a-discovery-profile.json

Identity claims map

Use this map to validate which Google token claims become Decionis actor context, traceability fields, and audit evidence.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-identity-claims-map.json

Marketplace readiness

Use this reviewer packet to distinguish shipped runtime controls from optional enterprise hardening and non-claims.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-marketplace-readiness.json

PSC consumer handoff

Use this packet when a regulated customer needs private endpoint setup, project allow-listing, validation, and rollback posture.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-psc-consumer-handoff.json

Trace SRE runbook

Use this packet to correlate Google trace headers, Decionis logs, dossiers, metering, pre-commit claims, overrides, and drift events during incident response.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-trace-sre-runbook.json

Billing readiness

Use this packet to validate verified_decision billing, ledger-first reconciliation, optional Service Control export, and replay behavior.

https://docs.decionis.com/google-cloud/vertex/decionis-vertex-billing-service-control-readiness.json

Client wrapper example

This TypeScript example is safe to wrap inside an ADK tool handler or any service that needs a thin Decionis verification call.

https://docs.decionis.com/examples/decionis-vertex-verify-client.ts