Semantic Action Resolver
What it does
Resolves what a call really does before any policy runs, seeing through obfuscation and formatting tricks meant to disguise the action.
It resolves a call to its true effect before any policy runs, seeing through base64, spacing, and formatting tricks, a delete disguised as 'd-e-l-e-t-e' is resolved to DELETE and caught, where a surface-text rule would wave it through.
When it applies
On every call, before policy evaluates it.
How it works
Before policy runs, the gateway resolves the call to its real effect, decoding obfuscation, encoding, and formatting tricks. The decision is then made on what the call actually does, not on its surface text.
In practice
A delete disguised as d-e-l-e-t-e or hidden in base64 is resolved to its true effect and caught, where a string-matching policy would miss it.
What you get
The resolved action and any deobfuscation signals are recorded on the decision.
Why it matters
A policy cannot be bypassed by reformatting or hiding the real action.
Attackers hide dangerous actions behind obfuscation and encoding so a naive string-matching policy misses them. The resolver decodes the real effect first, so policy decides on what the call actually does rather than how it looks.