Ir al contenido
Nexus Docs
↑↓Navigate↵SelectescClose

Policy Evaluation Baseline

Policy-evaluation performance budget and measurement shape for the gateway policy path

Last updated on:

Esta página aún no está disponible en tu idioma.

This document records the policy-evaluation performance budget and the measurement shape for the gateway policy path. The numbers are local characterization targets, not a public SLA.

Budget

Section titled “Budget”

Use the same local mock-upstream workload described in Gateway Chat Path: Performance Baseline: 100 RPS for 60 seconds against a loopback OpenAI-compatible mock upstream with short non-streaming chat requests.

Path Added p95 budget Added p99 budget Notes
Policy cache hit <= 5 ms <= 10 ms Includes query construction, cache lookup, and decision application.
Default-bundle cache miss <= 20 ms <= 50 ms Includes one default policy evaluation and audit emission.
Local in-process default engine <= 20 ms <= 50 ms Compared against an allow-only policy client in the same in-process gateway harness.

Any result above 2x the existing local gateway overhead in Gateway Chat Path: Performance Baseline blocks acceptance until investigated.

Required Measurement Fields

Section titled “Required Measurement Fields”

Every policy baseline run records:

  • Gateway p50 / p95 / p99 with policy enabled.
  • PDP evaluation p50 / p95 / p99 split by cache = hit | miss | disabled.
  • Cache-hit ratio.
  • policy.decision audit emission success count.
  • Gateway 4xx / 5xx counts.
  • Policy service CPU and memory notes from the local compose host.

Current Characterization

Section titled “Current Characterization”

The opt-in integration test is:

Terminal window
NEXUS_POLICY_PERF_RPS=100 \
NEXUS_POLICY_PERF_SECONDS=60 \
NEXUS_POLICY_PERF_WRITE_BASELINE=1 \
cargo test -p nexus-integration-tests --test first_proxied_request policy_gateway_latency_budget_smoke -- --ignored --nocapture

The test compares the policy-enabled gateway against the same in-process gateway using an allow-only policy client, then reports added p95 / p99 overhead. It is ignored by default because local p95 / p99 timings are noisy on shared developer machines.

Local Run: 2026-05-25

Section titled “Local Run: 2026-05-25”
  • Workload: 100 RPS for 60 seconds, 6 000 requests per path.
  • Baseline gateway: p50 19 ms, p95 28 ms, p99 30 ms, errors 0.
  • Policy gateway: p50 17 ms, p95 28 ms, p99 31 ms, errors 0.
  • Added overhead: p95 0 ms, p99 1 ms.
  • Result: within the default-bundle budget.

Notes:

  • This run measures the in-process default policy engine path against an allow-only policy client.
  • It does not measure an out-of-process gRPC PDP or Redis cache hit/miss behavior.

See Policy Obligations for the PolicyQuery/PolicyDecision wire contract this baseline exercises.