Graphorin API reference v0.4.0

---

Graphorin API reference / @graphorin/security / / createDataFlowPolicy

Function: createDataFlowPolicy()

function createDataFlowPolicy(config): DataFlowPolicy;

Defined in: packages/security/src/dataflow/policy.ts:52

Build a DataFlowPolicy from config.

Decision procedure for a sink call:

1. mode === 'off' or the tool is not a sink → allow.
2. Arguments carry untrusted content verbatim → untrusted-to-sink.
3. Else, if guardTrifecta (default on) and both untrusted and secret-tier content have entered the run → lethal-trifecta.
4. No tainted flow → allow.
5. A tainted flow into a declassifySinks sink → declassify (audited, allowed). Otherwise 'shadow' → flag (audited, allowed), 'enforce' → block.

Parameters

Parameter	Type
config	DataFlowPolicyConfig

Returns

DataFlowPolicy

Stable