# evaluate.rego — Policy evaluation entrypoint ================================
#
# Aggregates deny and warn rules across all control packages via walk().
# Automatically discovers new controls without manual registration.
# Query: data.evaluate.deny[_].summary

package evaluate

# Aggregate all deny violations across controls --------------------------------

deny contains msg if {
	walk(data.controls, [path, value])
	path[count(path) - 1] == "deny"
	msg := value[_]
	is_object(msg)
}

# Aggregate all warn violations across controls --------------------------------

warn contains msg if {
	walk(data.controls, [path, value])
	path[count(path) - 1] == "warn"
	msg := value[_]
	is_object(msg)
}