Upload 59 files

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.gitignore
+.next
+node_modules
+npm-debug.log*
+.env
+.env.*
+!.env.example
+coverage
+.nyc_output
+.DS_Store
+*.log

.env.example

@@ -0,0 +1,74 @@
+# ==============================================================
+# OPTIM AI BRE Engine — Environment Variables
+# STEP 1: Copy this file:  cp .env.example .env
+# STEP 2: Edit .env and change every CHANGE_ME value
+# NEVER commit .env to version control
+# ==============================================================
+
+# ==============================================================
+# POSTGRESQL
+# ==============================================================
+POSTGRES_DB=optimai_bre
+POSTGRES_USER=optimai
+POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD_HERE
+
+# ==============================================================
+# REDIS
+# ==============================================================
+REDIS_PASSWORD=CHANGE_ME_REDIS_PASSWORD_HERE
+
+# ==============================================================
+# JWT SECRET KEY
+# Must be minimum 32 characters, random string.
+# Generate one:
+#   Windows: -join ((65..90)+(97..122)+(48..57) | Get-Random -Count 64 | % {[char]$_})
+#   Linux:   openssl rand -base64 48
+# ==============================================================
+JWT_SECRET_KEY=CHANGE_ME_MINIMUM_32_CHAR_RANDOM_STRING_FOR_PRODUCTION
+
+JWT_ISSUER=OptimAI.BRE
+JWT_AUDIENCE=OptimAI.BRE.Clients
+JWT_ACCESS_TOKEN_EXPIRY_MINUTES=480
+JWT_REFRESH_TOKEN_EXPIRY_DAYS=30
+
+# ==============================================================
+# AI SERVICE (Optional — BRE works without this)
+# Leave AZURE_OPENAI_KEY blank to disable AI features.
+#
+# Option A — Azure OpenAI:
+#   USE_AZURE_OPENAI=true
+#   AZURE_OPENAI_ENDPOINT=https://YOUR-RESOURCE.openai.azure.com/
+#   AZURE_OPENAI_KEY=your-azure-openai-key
+#
+# Option B — OpenAI:
+#   USE_AZURE_OPENAI=false
+#   AZURE_OPENAI_KEY=sk-your-openai-key-here
+# ==============================================================
+USE_AZURE_OPENAI=false
+AZURE_OPENAI_ENDPOINT=
+AZURE_OPENAI_KEY=
+AZURE_OPENAI_MODEL=gpt-4o
+
+# ==============================================================
+# APPLICATION DOMAIN
+# Used for CORS allowed origins.
+# Set to your server IP or domain. Examples:
+#   http://192.168.1.100
+#   https://bre.yourcompany.com
+# ==============================================================
+APP_DOMAIN=http://localhost
+
+# ==============================================================
+# RULE ENGINE SETTINGS
+# ==============================================================
+RULE_ENGINE_MAX_CONCURRENT=100
+RULE_ENGINE_TIMEOUT_MS=5000
+RULE_ENGINE_CACHE_TTL_MINUTES=5
+LOG_LEVEL=Information
+
+# ==============================================================
+# POSTGRES VERSIONS (pin for reproducibility)
+# ==============================================================
+POSTGRES_VERSION=15-alpine
+REDIS_VERSION=7-alpine
+NGINX_VERSION=1.25-alpine

001_initial_schema.sql

@@ -0,0 +1,827 @@
+-- ============================================================
+-- OPTIM AI BRE ENGINE - COMPLETE DATABASE SCHEMA
+-- PostgreSQL 15+
+-- Multi-Tenant, Production-Grade
+-- ============================================================
+
+-- Enable extensions
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+CREATE EXTENSION IF NOT EXISTS "pg_trgm";
+
+-- ============================================================
+-- SCHEMA: TENANTS & MULTI-TENANCY
+-- ============================================================
+
+CREATE TABLE tenants (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_code         VARCHAR(50) UNIQUE NOT NULL,
+    tenant_name         VARCHAR(200) NOT NULL,
+    display_name        VARCHAR(200),
+    logo_url            TEXT,
+    primary_color       VARCHAR(10) DEFAULT '#1E40AF',
+    secondary_color     VARCHAR(10) DEFAULT '#3B82F6',
+    plan_type           VARCHAR(50) NOT NULL DEFAULT 'ENTERPRISE',  -- STARTER, PROFESSIONAL, ENTERPRISE
+    max_rules           INTEGER NOT NULL DEFAULT 1000,
+    max_executions_per_day BIGINT NOT NULL DEFAULT 1000000,
+    is_active           BOOLEAN NOT NULL DEFAULT TRUE,
+    trial_end_date      TIMESTAMPTZ,
+    subscription_end_date TIMESTAMPTZ,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    created_by          UUID,
+    settings            JSONB NOT NULL DEFAULT '{}'::JSONB
+);
+
+CREATE TABLE tenant_configurations (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    config_key      VARCHAR(200) NOT NULL,
+    config_value    TEXT,
+    config_type     VARCHAR(50) NOT NULL DEFAULT 'STRING', -- STRING, JSON, BOOLEAN, NUMBER
+    category        VARCHAR(100),
+    is_encrypted    BOOLEAN DEFAULT FALSE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, config_key)
+);
+
+-- ============================================================
+-- SCHEMA: IDENTITY & ACCESS MANAGEMENT
+-- ============================================================
+
+CREATE TABLE users (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id           UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    email               VARCHAR(320) NOT NULL,
+    username            VARCHAR(100) NOT NULL,
+    password_hash       TEXT NOT NULL,
+    full_name           VARCHAR(200) NOT NULL,
+    employee_id         VARCHAR(100),
+    designation         VARCHAR(200),
+    department          VARCHAR(200),
+    mobile              VARCHAR(20),
+    profile_image_url   TEXT,
+    is_active           BOOLEAN NOT NULL DEFAULT TRUE,
+    is_email_verified   BOOLEAN NOT NULL DEFAULT FALSE,
+    is_mfa_enabled      BOOLEAN NOT NULL DEFAULT FALSE,
+    mfa_secret          TEXT,
+    last_login_at       TIMESTAMPTZ,
+    last_login_ip       INET,
+    failed_login_count  INTEGER NOT NULL DEFAULT 0,
+    locked_until        TIMESTAMPTZ,
+    password_changed_at TIMESTAMPTZ,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, email),
+    UNIQUE(tenant_id, username)
+);
+
+CREATE TABLE roles (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    role_code       VARCHAR(100) NOT NULL,
+    role_name       VARCHAR(200) NOT NULL,
+    description     TEXT,
+    is_system_role  BOOLEAN NOT NULL DEFAULT FALSE,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, role_code)
+);
+
+CREATE TABLE permissions (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    permission_code VARCHAR(200) UNIQUE NOT NULL,
+    permission_name VARCHAR(200) NOT NULL,
+    module          VARCHAR(100) NOT NULL,
+    description     TEXT,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE role_permissions (
+    role_id         UUID NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
+    permission_id   UUID NOT NULL REFERENCES permissions(id) ON DELETE CASCADE,
+    granted_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    granted_by      UUID,
+    PRIMARY KEY (role_id, permission_id)
+);
+
+CREATE TABLE user_roles (
+    user_id     UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    role_id     UUID NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
+    assigned_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    assigned_by UUID,
+    PRIMARY KEY (user_id, role_id)
+);
+
+CREATE TABLE api_keys (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    key_name        VARCHAR(200) NOT NULL,
+    api_key_hash    TEXT NOT NULL UNIQUE,
+    api_key_prefix  VARCHAR(20) NOT NULL,
+    scopes          TEXT[] NOT NULL DEFAULT '{}',
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    expires_at      TIMESTAMPTZ,
+    last_used_at    TIMESTAMPTZ,
+    rate_limit_per_minute INTEGER NOT NULL DEFAULT 1000,
+    created_by      UUID NOT NULL REFERENCES users(id),
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE refresh_tokens (
+    id          UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    user_id     UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    token_hash  TEXT NOT NULL UNIQUE,
+    expires_at  TIMESTAMPTZ NOT NULL,
+    is_revoked  BOOLEAN NOT NULL DEFAULT FALSE,
+    ip_address  INET,
+    user_agent  TEXT,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ============================================================
+-- SCHEMA: PRODUCT & BRANCH CONFIGURATION
+-- ============================================================
+
+CREATE TABLE products (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    product_code    VARCHAR(100) NOT NULL,
+    product_name    VARCHAR(200) NOT NULL,
+    product_type    VARCHAR(100) NOT NULL, -- VEHICLE_LOAN, TRACTOR_LOAN, AUTO_LOAN, CV_LOAN, MSME, HOME_LOAN, PERSONAL_LOAN
+    description     TEXT,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    config          JSONB NOT NULL DEFAULT '{}'::JSONB,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, product_code)
+);
+
+CREATE TABLE branches (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    branch_code     VARCHAR(100) NOT NULL,
+    branch_name     VARCHAR(200) NOT NULL,
+    region          VARCHAR(100),
+    state           VARCHAR(100),
+    city            VARCHAR(100),
+    zone            VARCHAR(100),
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, branch_code)
+);
+
+CREATE TABLE loan_stages (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    stage_code      VARCHAR(100) NOT NULL,
+    stage_name      VARCHAR(200) NOT NULL,
+    stage_order     INTEGER NOT NULL DEFAULT 0,
+    description     TEXT,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, stage_code)
+);
+
+-- ============================================================
+-- SCHEMA: RULE ENGINE CORE
+-- ============================================================
+
+CREATE TABLE rule_categories (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    category_code   VARCHAR(100) NOT NULL,
+    category_name   VARCHAR(200) NOT NULL,
+    description     TEXT,
+    icon            VARCHAR(100),
+    sort_order      INTEGER NOT NULL DEFAULT 0,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, category_code)
+);
+
+CREATE TABLE rules (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id           UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    rule_code           VARCHAR(200) NOT NULL,
+    rule_name           VARCHAR(500) NOT NULL,
+    description         TEXT,
+    category_id         UUID REFERENCES rule_categories(id),
+    rule_type           VARCHAR(100) NOT NULL,  -- ELIGIBILITY, CREDIT, BUREAU, FI, VALUATION, FRAUD, COMPLIANCE, DEVIATION, INCOME, KYC
+    priority            INTEGER NOT NULL DEFAULT 100,
+    is_active           BOOLEAN NOT NULL DEFAULT TRUE,
+    is_published        BOOLEAN NOT NULL DEFAULT FALSE,
+    is_draft            BOOLEAN NOT NULL DEFAULT TRUE,
+    status              VARCHAR(50) NOT NULL DEFAULT 'DRAFT', -- DRAFT, PENDING_APPROVAL, APPROVED, PUBLISHED, ARCHIVED
+    current_version_id  UUID,
+    tags                TEXT[] DEFAULT '{}',
+    created_by          UUID NOT NULL REFERENCES users(id),
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, rule_code)
+);
+
+CREATE TABLE rule_versions (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    rule_id         UUID NOT NULL REFERENCES rules(id) ON DELETE CASCADE,
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    version_number  INTEGER NOT NULL,
+    version_label   VARCHAR(50),  -- e.g., v1.0, v1.1
+    rule_definition JSONB NOT NULL,  -- Complete rule AST
+    change_summary  TEXT,
+    is_current      BOOLEAN NOT NULL DEFAULT FALSE,
+    status          VARCHAR(50) NOT NULL DEFAULT 'DRAFT',
+    approved_by     UUID REFERENCES users(id),
+    approved_at     TIMESTAMPTZ,
+    published_by    UUID REFERENCES users(id),
+    published_at    TIMESTAMPTZ,
+    created_by      UUID NOT NULL REFERENCES users(id),
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(rule_id, version_number)
+);
+
+-- Rule Definition JSON Structure (stored in rule_versions.rule_definition):
+-- {
+--   "conditions": {
+--     "operator": "AND|OR",
+--     "rules": [
+--       {
+--         "id": "uuid",
+--         "field": "bureau_score",
+--         "operator": "LESS_THAN",
+--         "value": 650,
+--         "valueType": "NUMBER"
+--       },
+--       {
+--         "operator": "OR",
+--         "rules": [...]  -- nested group
+--       }
+--     ]
+--   },
+--   "actions": [
+--     { "type": "SET_DECISION", "value": "REJECT" },
+--     { "type": "SET_RISK", "value": "HIGH" },
+--     { "type": "ADD_DEVIATION", "value": "LOW_BUREAU_SCORE" },
+--     { "type": "SET_FIELD", "field": "recommendation", "value": "Reject" }
+--   ],
+--   "metadata": {
+--     "executionOrder": 1,
+--     "stopOnMatch": true,
+--     "errorHandling": "SKIP"
+--   }
+-- }
+
+CREATE TABLE rule_scopes (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    rule_id         UUID NOT NULL REFERENCES rules(id) ON DELETE CASCADE,
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    scope_type      VARCHAR(50) NOT NULL, -- PRODUCT, BRANCH, STAGE, USER_ROLE, GLOBAL
+    scope_value     VARCHAR(200) NOT NULL, -- product_code, branch_code, stage_code, role_code, or '*' for all
+    is_excluded     BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE rule_sets (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    set_code        VARCHAR(200) NOT NULL,
+    set_name        VARCHAR(500) NOT NULL,
+    description     TEXT,
+    execution_mode  VARCHAR(50) NOT NULL DEFAULT 'ALL', -- ALL, FIRST_MATCH, SCORED
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_by      UUID NOT NULL REFERENCES users(id),
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, set_code)
+);
+
+CREATE TABLE rule_set_members (
+    id          UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    set_id      UUID NOT NULL REFERENCES rule_sets(id) ON DELETE CASCADE,
+    rule_id     UUID NOT NULL REFERENCES rules(id) ON DELETE CASCADE,
+    sort_order  INTEGER NOT NULL DEFAULT 0,
+    weight      DECIMAL(5,2) DEFAULT 1.0,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(set_id, rule_id)
+);
+
+-- ============================================================
+-- SCHEMA: FIELD CATALOG (Dynamic Field Mapping)
+-- ============================================================
+
+CREATE TABLE field_catalog (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID REFERENCES tenants(id) ON DELETE CASCADE, -- NULL = global
+    field_path      VARCHAR(500) NOT NULL,  -- e.g., "bureau.cibil_score", "applicant.age"
+    display_name    VARCHAR(200) NOT NULL,
+    description     TEXT,
+    data_type       VARCHAR(50) NOT NULL,   -- NUMBER, STRING, BOOLEAN, DATE, ARRAY, OBJECT
+    category        VARCHAR(100),           -- BUREAU, INCOME, PERSONAL, VEHICLE, etc.
+    sample_values   JSONB,
+    validation_rules JSONB,
+    is_system_field BOOLEAN NOT NULL DEFAULT FALSE,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, field_path)
+);
+
+CREATE TABLE custom_functions (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID REFERENCES tenants(id) ON DELETE CASCADE,
+    function_name   VARCHAR(200) NOT NULL,
+    display_name    VARCHAR(200) NOT NULL,
+    description     TEXT,
+    category        VARCHAR(100),
+    return_type     VARCHAR(50) NOT NULL,
+    parameters      JSONB NOT NULL DEFAULT '[]'::JSONB,
+    implementation  TEXT NOT NULL,  -- C# expression or script
+    is_system_fn    BOOLEAN NOT NULL DEFAULT FALSE,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, function_name)
+);
+
+-- ============================================================
+-- SCHEMA: EXECUTION ENGINE
+-- ============================================================
+
+CREATE TABLE execution_requests (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id           UUID NOT NULL REFERENCES tenants(id),
+    correlation_id      VARCHAR(200) UNIQUE,
+    application_id      VARCHAR(200),
+    product_code        VARCHAR(100),
+    branch_code         VARCHAR(100),
+    stage_code          VARCHAR(100),
+    rule_set_id         UUID REFERENCES rule_sets(id),
+    input_payload       JSONB NOT NULL,
+    input_hash          VARCHAR(64),
+    status              VARCHAR(50) NOT NULL DEFAULT 'PENDING', -- PENDING, PROCESSING, COMPLETED, FAILED
+    priority            INTEGER NOT NULL DEFAULT 5,
+    source_system       VARCHAR(200),
+    api_key_id          UUID REFERENCES api_keys(id),
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    processing_started_at TIMESTAMPTZ,
+    completed_at        TIMESTAMPTZ,
+    processing_ms       INTEGER
+);
+
+CREATE TABLE execution_results (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    request_id          UUID NOT NULL REFERENCES execution_requests(id) ON DELETE CASCADE,
+    tenant_id           UUID NOT NULL REFERENCES tenants(id),
+    final_decision      VARCHAR(50) NOT NULL, -- APPROVE, REJECT, DEVIATION, REFER, PENDING
+    risk_score          DECIMAL(5,2),
+    risk_category       VARCHAR(50), -- LOW, MEDIUM, HIGH, CRITICAL
+    traffic_light       VARCHAR(10), -- GREEN, AMBER, RED
+    total_rules_evaluated INTEGER NOT NULL DEFAULT 0,
+    rules_passed        INTEGER NOT NULL DEFAULT 0,
+    rules_failed        INTEGER NOT NULL DEFAULT 0,
+    rules_skipped       INTEGER NOT NULL DEFAULT 0,
+    deviations_count    INTEGER NOT NULL DEFAULT 0,
+    execution_ms        INTEGER,
+    rule_results        JSONB NOT NULL DEFAULT '[]'::JSONB,
+    field_values        JSONB NOT NULL DEFAULT '{}'::JSONB,
+    ai_summary          TEXT,
+    ai_analysis         JSONB,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE rule_execution_details (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    result_id       UUID NOT NULL REFERENCES execution_results(id) ON DELETE CASCADE,
+    rule_id         UUID NOT NULL REFERENCES rules(id),
+    rule_code       VARCHAR(200) NOT NULL,
+    rule_name       VARCHAR(500) NOT NULL,
+    version_number  INTEGER NOT NULL,
+    execution_order INTEGER NOT NULL,
+    is_matched      BOOLEAN NOT NULL,
+    conditions_evaluated JSONB NOT NULL DEFAULT '[]'::JSONB,
+    actions_executed JSONB NOT NULL DEFAULT '[]'::JSONB,
+    execution_ms    INTEGER,
+    error_message   TEXT,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ============================================================
+-- SCHEMA: DEVIATIONS
+-- ============================================================
+
+CREATE TABLE deviation_types (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id           UUID REFERENCES tenants(id) ON DELETE CASCADE,
+    deviation_code      VARCHAR(200) NOT NULL,
+    deviation_name      VARCHAR(500) NOT NULL,
+    category            VARCHAR(100),
+    default_severity    VARCHAR(50) NOT NULL DEFAULT 'MEDIUM', -- LOW, MEDIUM, HIGH, CRITICAL
+    description         TEXT,
+    recommended_action  TEXT,
+    requires_approval   BOOLEAN NOT NULL DEFAULT FALSE,
+    approver_role       VARCHAR(200),
+    is_active           BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, deviation_code)
+);
+
+CREATE TABLE execution_deviations (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    result_id       UUID NOT NULL REFERENCES execution_results(id) ON DELETE CASCADE,
+    rule_id         UUID REFERENCES rules(id),
+    deviation_type_id UUID REFERENCES deviation_types(id),
+    deviation_code  VARCHAR(200) NOT NULL,
+    deviation_name  VARCHAR(500) NOT NULL,
+    severity        VARCHAR(50) NOT NULL,
+    reason          TEXT NOT NULL,
+    field_path      VARCHAR(500),
+    actual_value    TEXT,
+    expected_value  TEXT,
+    recommended_action TEXT,
+    is_overridden   BOOLEAN NOT NULL DEFAULT FALSE,
+    overridden_by   UUID REFERENCES users(id),
+    override_reason TEXT,
+    override_at     TIMESTAMPTZ,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ============================================================
+-- SCHEMA: DECISION REPORTS
+-- ============================================================
+
+CREATE TABLE decision_reports (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    request_id          UUID NOT NULL UNIQUE REFERENCES execution_requests(id),
+    tenant_id           UUID NOT NULL REFERENCES tenants(id),
+    report_number       VARCHAR(100) UNIQUE,
+    application_id      VARCHAR(200),
+    product_code        VARCHAR(100),
+    final_decision      VARCHAR(50) NOT NULL,
+    risk_score          DECIMAL(5,2),
+    risk_category       VARCHAR(50),
+    traffic_light       VARCHAR(10),
+    summary             TEXT,
+    strengths           TEXT[],
+    weaknesses          TEXT[],
+    deviations_summary  TEXT,
+    approval_recommendation TEXT,
+    rejection_reasons   TEXT[],
+    additional_docs     TEXT[],
+    underwriting_notes  TEXT,
+    report_json         JSONB,
+    pdf_storage_path    TEXT,
+    excel_storage_path  TEXT,
+    generated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at          TIMESTAMPTZ
+);
+
+-- ============================================================
+-- SCHEMA: SANDBOX & TESTING
+-- ============================================================
+
+CREATE TABLE sandbox_sessions (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    session_name    VARCHAR(200) NOT NULL,
+    rule_set_id     UUID REFERENCES rule_sets(id),
+    test_payload    JSONB NOT NULL,
+    result          JSONB,
+    status          VARCHAR(50) NOT NULL DEFAULT 'PENDING',
+    created_by      UUID NOT NULL REFERENCES users(id),
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    executed_at     TIMESTAMPTZ
+);
+
+-- ============================================================
+-- SCHEMA: AI ENGINE
+-- ============================================================
+
+CREATE TABLE ai_prompts (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID REFERENCES tenants(id) ON DELETE CASCADE,
+    prompt_code     VARCHAR(200) NOT NULL,
+    prompt_name     VARCHAR(300) NOT NULL,
+    prompt_template TEXT NOT NULL,
+    model           VARCHAR(100) DEFAULT 'gpt-4o',
+    temperature     DECIMAL(3,2) DEFAULT 0.3,
+    max_tokens      INTEGER DEFAULT 2000,
+    is_system       BOOLEAN NOT NULL DEFAULT FALSE,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, prompt_code)
+);
+
+CREATE TABLE ai_generated_rules (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    user_prompt     TEXT NOT NULL,
+    generated_rule  JSONB NOT NULL,
+    rule_id         UUID REFERENCES rules(id),
+    model_used      VARCHAR(100),
+    tokens_used     INTEGER,
+    is_accepted     BOOLEAN,
+    feedback        TEXT,
+    created_by      UUID NOT NULL REFERENCES users(id),
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ============================================================
+-- SCHEMA: AUDIT & COMPLIANCE
+-- ============================================================
+
+CREATE TABLE audit_logs (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id       UUID NOT NULL REFERENCES tenants(id),
+    user_id         UUID REFERENCES users(id),
+    action          VARCHAR(200) NOT NULL,
+    entity_type     VARCHAR(100) NOT NULL,
+    entity_id       VARCHAR(200),
+    old_values      JSONB,
+    new_values      JSONB,
+    ip_address      INET,
+    user_agent      TEXT,
+    request_id      VARCHAR(200),
+    is_success      BOOLEAN NOT NULL DEFAULT TRUE,
+    error_message   TEXT,
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE rule_approvals (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    rule_id         UUID NOT NULL REFERENCES rules(id) ON DELETE CASCADE,
+    version_id      UUID NOT NULL REFERENCES rule_versions(id) ON DELETE CASCADE,
+    tenant_id       UUID NOT NULL REFERENCES tenants(id),
+    requested_by    UUID NOT NULL REFERENCES users(id),
+    requested_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    reviewed_by     UUID REFERENCES users(id),
+    reviewed_at     TIMESTAMPTZ,
+    status          VARCHAR(50) NOT NULL DEFAULT 'PENDING', -- PENDING, APPROVED, REJECTED
+    comments        TEXT,
+    notification_sent BOOLEAN NOT NULL DEFAULT FALSE
+);
+
+-- ============================================================
+-- SCHEMA: MARKETPLACE
+-- ============================================================
+
+CREATE TABLE marketplace_rules (
+    id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    rule_code       VARCHAR(200) UNIQUE NOT NULL,
+    rule_name       VARCHAR(500) NOT NULL,
+    description     TEXT,
+    category        VARCHAR(100),
+    product_types   TEXT[],
+    rule_definition JSONB NOT NULL,
+    author          VARCHAR(200),
+    version         VARCHAR(50),
+    downloads       INTEGER NOT NULL DEFAULT 0,
+    rating          DECIMAL(3,2) DEFAULT 0,
+    tags            TEXT[],
+    is_featured     BOOLEAN NOT NULL DEFAULT FALSE,
+    is_active       BOOLEAN NOT NULL DEFAULT TRUE,
+    published_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE TABLE marketplace_imports (
+    id                  UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    tenant_id           UUID NOT NULL REFERENCES tenants(id),
+    marketplace_rule_id UUID NOT NULL REFERENCES marketplace_rules(id),
+    imported_rule_id    UUID REFERENCES rules(id),
+    imported_by         UUID NOT NULL REFERENCES users(id),
+    imported_at         TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- ============================================================
+-- INDEXES FOR PERFORMANCE
+-- ============================================================
+
+-- Tenant isolation indexes
+CREATE INDEX idx_rules_tenant ON rules(tenant_id) WHERE is_active = TRUE;
+CREATE INDEX idx_rules_tenant_category ON rules(tenant_id, category_id) WHERE is_active = TRUE;
+CREATE INDEX idx_rules_tenant_type ON rules(tenant_id, rule_type) WHERE is_active = TRUE AND is_published = TRUE;
+CREATE INDEX idx_rule_scopes_rule ON rule_scopes(rule_id);
+CREATE INDEX idx_rule_scopes_tenant_type ON rule_scopes(tenant_id, scope_type, scope_value);
+
+-- Execution performance indexes
+CREATE INDEX idx_exec_requests_tenant_status ON execution_requests(tenant_id, status, created_at DESC);
+CREATE INDEX idx_exec_requests_correlation ON execution_requests(correlation_id);
+CREATE INDEX idx_exec_results_request ON execution_results(request_id);
+CREATE INDEX idx_exec_results_tenant_decision ON execution_results(tenant_id, final_decision, created_at DESC);
+CREATE INDEX idx_rule_exec_details_result ON rule_execution_details(result_id);
+
+-- Audit indexes
+CREATE INDEX idx_audit_tenant_entity ON audit_logs(tenant_id, entity_type, entity_id, created_at DESC);
+CREATE INDEX idx_audit_tenant_user ON audit_logs(tenant_id, user_id, created_at DESC);
+
+-- User lookup
+CREATE INDEX idx_users_tenant_email ON users(tenant_id, email) WHERE is_active = TRUE;
+CREATE INDEX idx_users_tenant_username ON users(tenant_id, username) WHERE is_active = TRUE;
+
+-- Field catalog full-text
+CREATE INDEX idx_field_catalog_path ON field_catalog USING GIN(to_tsvector('english', field_path || ' ' || display_name));
+
+-- Execution date range queries
+CREATE INDEX idx_exec_requests_tenant_date ON execution_requests(tenant_id, created_at DESC);
+CREATE INDEX idx_decision_reports_tenant ON decision_reports(tenant_id, generated_at DESC);
+
+-- ============================================================
+-- SEED DATA: SYSTEM PERMISSIONS
+-- ============================================================
+
+INSERT INTO permissions (permission_code, permission_name, module, description) VALUES
+-- Rule Management
+('RULE.VIEW', 'View Rules', 'RULE_ENGINE', 'View all rules'),
+('RULE.CREATE', 'Create Rules', 'RULE_ENGINE', 'Create new rules'),
+('RULE.EDIT', 'Edit Rules', 'RULE_ENGINE', 'Edit existing rules'),
+('RULE.DELETE', 'Delete Rules', 'RULE_ENGINE', 'Delete rules'),
+('RULE.PUBLISH', 'Publish Rules', 'RULE_ENGINE', 'Publish rules to production'),
+('RULE.APPROVE', 'Approve Rules', 'RULE_ENGINE', 'Approve rule changes'),
+('RULE.CLONE', 'Clone Rules', 'RULE_ENGINE', 'Clone existing rules'),
+('RULE.VERSION', 'Manage Rule Versions', 'RULE_ENGINE', 'View and manage rule versions'),
+-- Execution
+('EXECUTION.VIEW', 'View Executions', 'EXECUTION', 'View execution results'),
+('EXECUTION.EXECUTE', 'Execute Rules', 'EXECUTION', 'Execute rule engine via API'),
+('EXECUTION.SANDBOX', 'Use Sandbox', 'EXECUTION', 'Use sandbox testing environment'),
+-- Client Management
+('CLIENT.VIEW', 'View Clients', 'CLIENT_MGMT', 'View client list'),
+('CLIENT.CREATE', 'Create Clients', 'CLIENT_MGMT', 'Create new clients'),
+('CLIENT.EDIT', 'Edit Clients', 'CLIENT_MGMT', 'Edit client configuration'),
+('CLIENT.MANAGE_USERS', 'Manage Client Users', 'CLIENT_MGMT', 'Manage users within tenant'),
+-- Reports
+('REPORT.VIEW', 'View Reports', 'REPORTS', 'View decision reports'),
+('REPORT.EXPORT', 'Export Reports', 'REPORTS', 'Export reports to PDF/Excel'),
+-- AI Engine
+('AI.GENERATE', 'AI Rule Generation', 'AI_ENGINE', 'Use AI to generate rules'),
+('AI.ANALYSIS', 'AI Credit Analysis', 'AI_ENGINE', 'Access AI credit analysis'),
+-- Admin
+('ADMIN.FULL', 'Full Admin Access', 'ADMIN', 'Complete administrative access'),
+('AUDIT.VIEW', 'View Audit Logs', 'AUDIT', 'Access audit trail');
+
+-- ============================================================
+-- SEED DATA: GLOBAL FIELD CATALOG
+-- ============================================================
+
+INSERT INTO field_catalog (field_path, display_name, data_type, category, is_system_field) VALUES
+-- Personal
+('applicant.age', 'Applicant Age', 'NUMBER', 'PERSONAL', TRUE),
+('applicant.date_of_birth', 'Date of Birth', 'DATE', 'PERSONAL', TRUE),
+('applicant.gender', 'Gender', 'STRING', 'PERSONAL', TRUE),
+('applicant.pan_number', 'PAN Number', 'STRING', 'KYC', TRUE),
+('applicant.aadhaar_number', 'Aadhaar Number', 'STRING', 'KYC', TRUE),
+('applicant.mobile', 'Mobile Number', 'STRING', 'PERSONAL', TRUE),
+('applicant.email', 'Email Address', 'STRING', 'PERSONAL', TRUE),
+('applicant.marital_status', 'Marital Status', 'STRING', 'PERSONAL', TRUE),
+('applicant.caste_category', 'Caste Category', 'STRING', 'PERSONAL', TRUE),
+-- Employment
+('employment.type', 'Employment Type', 'STRING', 'EMPLOYMENT', TRUE),
+('employment.employer_name', 'Employer Name', 'STRING', 'EMPLOYMENT', TRUE),
+('employment.monthly_income', 'Monthly Income', 'NUMBER', 'INCOME', TRUE),
+('employment.annual_income', 'Annual Income', 'NUMBER', 'INCOME', TRUE),
+('employment.vintage_months', 'Employment Vintage (Months)', 'NUMBER', 'EMPLOYMENT', TRUE),
+-- Bureau
+('bureau.cibil_score', 'CIBIL Score', 'NUMBER', 'BUREAU', TRUE),
+('bureau.experian_score', 'Experian Score', 'NUMBER', 'BUREAU', TRUE),
+('bureau.equifax_score', 'Equifax Score', 'NUMBER', 'BUREAU', TRUE),
+('bureau.crif_score', 'CRIF Score', 'NUMBER', 'BUREAU', TRUE),
+('bureau.max_dpd_24m', 'Max DPD (24 Months)', 'NUMBER', 'BUREAU', TRUE),
+('bureau.max_dpd_12m', 'Max DPD (12 Months)', 'NUMBER', 'BUREAU', TRUE),
+('bureau.total_active_loans', 'Total Active Loans', 'NUMBER', 'BUREAU', TRUE),
+('bureau.unsecured_outstanding', 'Unsecured Outstanding Amount', 'NUMBER', 'BUREAU', TRUE),
+('bureau.secured_outstanding', 'Secured Outstanding Amount', 'NUMBER', 'BUREAU', TRUE),
+('bureau.total_emi_obligation', 'Total EMI Obligation', 'NUMBER', 'BUREAU', TRUE),
+('bureau.written_off_amount', 'Written Off Amount', 'NUMBER', 'BUREAU', TRUE),
+('bureau.suit_filed', 'Suit Filed', 'BOOLEAN', 'BUREAU', TRUE),
+('bureau.wilful_defaulter', 'Wilful Defaulter', 'BOOLEAN', 'BUREAU', TRUE),
+-- Income Ratios
+('ratios.foir', 'FOIR (Fixed Obligation to Income Ratio)', 'NUMBER', 'RATIOS', TRUE),
+('ratios.ltv', 'LTV (Loan to Value Ratio)', 'NUMBER', 'RATIOS', TRUE),
+('ratios.dscr', 'DSCR (Debt Service Coverage Ratio)', 'NUMBER', 'RATIOS', TRUE),
+-- Loan
+('loan.amount', 'Loan Amount', 'NUMBER', 'LOAN', TRUE),
+('loan.tenure_months', 'Loan Tenure (Months)', 'NUMBER', 'LOAN', TRUE),
+('loan.emi', 'EMI Amount', 'NUMBER', 'LOAN', TRUE),
+('loan.interest_rate', 'Interest Rate', 'NUMBER', 'LOAN', TRUE),
+('loan.purpose', 'Loan Purpose', 'STRING', 'LOAN', TRUE),
+-- Vehicle
+('vehicle.type', 'Vehicle Type', 'STRING', 'VEHICLE', TRUE),
+('vehicle.make', 'Vehicle Make', 'STRING', 'VEHICLE', TRUE),
+('vehicle.model', 'Vehicle Model', 'STRING', 'VEHICLE', TRUE),
+('vehicle.year', 'Vehicle Year', 'NUMBER', 'VEHICLE', TRUE),
+('vehicle.age_years', 'Vehicle Age (Years)', 'NUMBER', 'VEHICLE', TRUE),
+('vehicle.valuation', 'Vehicle Valuation', 'NUMBER', 'VEHICLE', TRUE),
+('vehicle.registration_number', 'Registration Number', 'STRING', 'VEHICLE', TRUE),
+-- FI
+('fi.verified', 'FI Verified', 'BOOLEAN', 'FI', TRUE),
+('fi.residence_type', 'Residence Type', 'STRING', 'FI', TRUE),
+('fi.address_match', 'Address Match', 'BOOLEAN', 'FI', TRUE),
+('fi.mobile_match', 'Mobile Match', 'BOOLEAN', 'FI', TRUE),
+('fi.negative', 'FI Negative', 'BOOLEAN', 'FI', TRUE),
+-- GST & ITR
+('gst.turnover', 'GST Turnover', 'NUMBER', 'GST', TRUE),
+('gst.filing_months', 'GST Filing Months', 'NUMBER', 'GST', TRUE),
+('itr.gross_income', 'ITR Gross Income', 'NUMBER', 'ITR', TRUE),
+('itr.net_income', 'ITR Net Income', 'NUMBER', 'ITR', TRUE),
+('itr.years_filed', 'ITR Years Filed', 'NUMBER', 'ITR', TRUE),
+-- Fraud
+('fraud.score', 'Fraud Score', 'NUMBER', 'FRAUD', TRUE),
+('fraud.blacklisted', 'Blacklisted', 'BOOLEAN', 'FRAUD', TRUE),
+('fraud.device_score', 'Device Risk Score', 'NUMBER', 'FRAUD', TRUE);
+
+-- ============================================================
+-- SEED DATA: DEVIATION TYPES
+-- ============================================================
+
+INSERT INTO deviation_types (deviation_code, deviation_name, category, default_severity, description, recommended_action) VALUES
+('LOW_BUREAU_SCORE', 'Low Bureau Score', 'BUREAU', 'HIGH', 'Bureau/CIBIL score below threshold', 'Obtain credit counseling letter or additional collateral'),
+('HIGH_DPD', 'High DPD', 'BUREAU', 'HIGH', 'Days Past Due exceeds acceptable limit', 'Explain previous defaults with supporting docs'),
+('HIGH_FOIR', 'High FOIR', 'INCOME', 'MEDIUM', 'Fixed Obligation to Income Ratio exceeds limit', 'Consider reducing loan amount or tenure'),
+('INCOME_MISMATCH', 'Income Mismatch', 'INCOME', 'MEDIUM', 'Stated income does not match verified income', 'Provide additional income proof documents'),
+('NEGATIVE_FI', 'Negative FI Report', 'FI', 'HIGH', 'Field Investigation report is negative', 'Second FI verification required'),
+('ADDRESS_MISMATCH', 'Address Mismatch', 'FI', 'MEDIUM', 'Applicant address does not match records', 'Obtain additional address proof'),
+('MOBILE_MISMATCH', 'Mobile Number Mismatch', 'FI', 'LOW', 'Mobile number not matching bureau records', 'Verify mobile ownership'),
+('HIGH_LTV', 'High LTV', 'VALUATION', 'MEDIUM', 'Loan to Value ratio exceeds limit', 'Additional down payment required'),
+('VEHICLE_AGE', 'Vehicle Age Deviation', 'VEHICLE', 'MEDIUM', 'Vehicle age exceeds permissible limit', 'Obtain extended warranty or reduce tenure'),
+('MULTIPLE_LOANS', 'Multiple Active Loans', 'BUREAU', 'MEDIUM', 'High number of active loans', 'Review repayment capacity'),
+('WRITTEN_OFF', 'Written Off Account', 'BUREAU', 'CRITICAL', 'Previous written off account found', 'NOC from previous lender required'),
+('SUIT_FILED', 'Suit Filed', 'BUREAU', 'CRITICAL', 'Legal suit filed against applicant', 'Legal verification required'),
+('AGE_DEVIATION', 'Age Deviation', 'PERSONAL', 'MEDIUM', 'Applicant age outside standard limits', 'Additional life insurance required'),
+('LOW_VINTAGE', 'Low Employment Vintage', 'EMPLOYMENT', 'LOW', 'Employment tenure below minimum threshold', 'Previous employment proof required'),
+('LOW_GST_FILING', 'Low GST Filing Compliance', 'GST', 'MEDIUM', 'GST filing not consistent', 'Last 12 months GST returns required'),
+('FRAUD_RISK', 'Fraud Risk Detected', 'FRAUD', 'CRITICAL', 'High fraud risk score detected', 'Enhanced due diligence required');
+
+-- ============================================================
+-- TRIGGERS: AUTO UPDATE TIMESTAMPS
+-- ============================================================
+
+CREATE OR REPLACE FUNCTION update_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = NOW();
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER trg_tenants_updated_at BEFORE UPDATE ON tenants FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+CREATE TRIGGER trg_users_updated_at BEFORE UPDATE ON users FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+CREATE TRIGGER trg_roles_updated_at BEFORE UPDATE ON roles FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+CREATE TRIGGER trg_rules_updated_at BEFORE UPDATE ON rules FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+CREATE TRIGGER trg_rule_sets_updated_at BEFORE UPDATE ON rule_sets FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+
+-- Auto-generate report number
+CREATE OR REPLACE FUNCTION generate_report_number()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.report_number = 'BRE-' || TO_CHAR(NOW(), 'YYYYMMDD') || '-' || LPAD(nextval('report_seq')::TEXT, 6, '0');
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE SEQUENCE IF NOT EXISTS report_seq START 1;
+CREATE TRIGGER trg_decision_report_number BEFORE INSERT ON decision_reports FOR EACH ROW EXECUTE FUNCTION generate_report_number();
+
+-- ============================================================
+-- VIEWS FOR ANALYTICS
+-- ============================================================
+
+CREATE OR REPLACE VIEW v_execution_summary AS
+SELECT
+    er.tenant_id,
+    DATE_TRUNC('day', eq.created_at) AS execution_date,
+    COUNT(*) AS total_executions,
+    SUM(CASE WHEN er.final_decision = 'APPROVE' THEN 1 ELSE 0 END) AS approved,
+    SUM(CASE WHEN er.final_decision = 'REJECT' THEN 1 ELSE 0 END) AS rejected,
+    SUM(CASE WHEN er.final_decision = 'DEVIATION' THEN 1 ELSE 0 END) AS deviations,
+    ROUND(AVG(er.risk_score), 2) AS avg_risk_score,
+    ROUND(AVG(eq.processing_ms), 0) AS avg_processing_ms,
+    SUM(CASE WHEN er.final_decision = 'APPROVE' THEN 1 ELSE 0 END) * 100.0 / COUNT(*) AS approval_rate
+FROM execution_results er
+JOIN execution_requests eq ON eq.id = er.request_id
+GROUP BY er.tenant_id, DATE_TRUNC('day', eq.created_at);
+
+CREATE OR REPLACE VIEW v_rule_hit_analysis AS
+SELECT
+    red.rule_id,
+    r.rule_code,
+    r.rule_name,
+    r.tenant_id,
+    COUNT(*) AS total_evaluations,
+    SUM(CASE WHEN red.is_matched THEN 1 ELSE 0 END) AS matched_count,
+    ROUND(SUM(CASE WHEN red.is_matched THEN 1 ELSE 0 END) * 100.0 / COUNT(*), 2) AS hit_rate,
+    ROUND(AVG(red.execution_ms), 0) AS avg_execution_ms
+FROM rule_execution_details red
+JOIN rules r ON r.id = red.rule_id
+GROUP BY red.rule_id, r.rule_code, r.rule_name, r.tenant_id;
+
+CREATE OR REPLACE VIEW v_deviation_analysis AS
+SELECT
+    ed.tenant_id,
+    ed.deviation_code,
+    ed.deviation_name,
+    ed.severity,
+    COUNT(*) AS occurrence_count,
+    SUM(CASE WHEN ed.is_overridden THEN 1 ELSE 0 END) AS override_count,
+    DATE_TRUNC('month', ed.created_at) AS month
+FROM execution_deviations ed
+GROUP BY ed.tenant_id, ed.deviation_code, ed.deviation_name, ed.severity, DATE_TRUNC('month', ed.created_at);

002_seed_admin.sql

@@ -0,0 +1,173 @@
+-- ============================================================
+-- OPTIM AI BRE ENGINE - SEED: ADMIN TENANT + USER
+-- Run AFTER 001_initial_schema.sql
+-- Password: Admin@1234  (BCrypt hash below)
+-- ============================================================
+
+-- Step 1: Create the default SYSTEM tenant
+INSERT INTO tenants (
+    id, tenant_code, tenant_name, display_name,
+    plan_type, max_rules, max_executions_per_day,
+    is_active, settings
+) VALUES (
+    'a0000000-0000-0000-0000-000000000001',
+    'SYSTEM',
+    'OPTIM AI - System Tenant',
+    'System Admin',
+    'ENTERPRISE',
+    99999,
+    99999999,
+    TRUE,
+    '{"isSystem": true}'::jsonb
+) ON CONFLICT (tenant_code) DO NOTHING;
+
+-- Step 2: Create SUPER_ADMIN role for the system tenant
+INSERT INTO roles (
+    id, tenant_id, role_code, role_name, description,
+    is_system_role, is_active
+) VALUES (
+    'b0000000-0000-0000-0000-000000000001',
+    'a0000000-0000-0000-0000-000000000001',
+    'SUPER_ADMIN',
+    'Super Administrator',
+    'Full system access - all permissions',
+    TRUE, TRUE
+) ON CONFLICT DO NOTHING;
+
+-- Step 3: Grant ALL permissions to SUPER_ADMIN
+INSERT INTO role_permissions (role_id, permission_id)
+SELECT
+    'b0000000-0000-0000-0000-000000000001',
+    p.id
+FROM permissions p
+ON CONFLICT DO NOTHING;
+
+-- Step 4: Create the admin user
+-- Email: admin@optimai.in
+-- Password: Admin@1234
+-- BCrypt hash generated with work factor 12
+INSERT INTO users (
+    id, tenant_id, email, username, password_hash,
+    full_name, designation, department,
+    is_active, is_email_verified
+) VALUES (
+    'c0000000-0000-0000-0000-000000000001',
+    'a0000000-0000-0000-0000-000000000001',
+    'admin@optimai.in',
+    'admin',
+    '$2a$12$LQv3c1yqBWVHxkd0LHAkCOYz6TtxMQJqhN8/Lewjoc.MiG6L6bHQW',
+    'System Administrator',
+    'Platform Administrator',
+    'Technology',
+    TRUE,
+    TRUE
+) ON CONFLICT (tenant_id, email) DO NOTHING;
+
+-- Step 5: Assign SUPER_ADMIN role to admin user
+INSERT INTO user_roles (user_id, role_id)
+VALUES (
+    'c0000000-0000-0000-0000-000000000001',
+    'b0000000-0000-0000-0000-000000000001'
+) ON CONFLICT DO NOTHING;
+
+-- Step 6: Create a DEMO tenant for testing multi-tenancy
+INSERT INTO tenants (
+    id, tenant_code, tenant_name, display_name,
+    plan_type, max_rules, max_executions_per_day, is_active, settings
+) VALUES (
+    'a0000000-0000-0000-0000-000000000002',
+    'DEMO_BANK',
+    'Demo Bank Ltd',
+    'Demo Bank',
+    'ENTERPRISE', 500, 100000, TRUE,
+    '{"productTypes": ["VEHICLE_LOAN","TRACTOR_LOAN","MSME"]}'::jsonb
+) ON CONFLICT (tenant_code) DO NOTHING;
+
+-- Step 7: Create CREDIT_MANAGER role for Demo Bank
+INSERT INTO roles (id, tenant_id, role_code, role_name, is_system_role, is_active)
+VALUES (
+    'b0000000-0000-0000-0000-000000000002',
+    'a0000000-0000-0000-0000-000000000002',
+    'CREDIT_MANAGER', 'Credit Manager', FALSE, TRUE
+) ON CONFLICT DO NOTHING;
+
+-- Step 8: Grant rule permissions to CREDIT_MANAGER
+INSERT INTO role_permissions (role_id, permission_id)
+SELECT 'b0000000-0000-0000-0000-000000000002', p.id
+FROM permissions p
+WHERE p.permission_code IN (
+    'RULE.VIEW','RULE.CREATE','RULE.EDIT','RULE.CLONE',
+    'EXECUTION.VIEW','EXECUTION.EXECUTE','EXECUTION.SANDBOX',
+    'REPORT.VIEW','REPORT.EXPORT','AI.GENERATE','AI.ANALYSIS',
+    'AUDIT.VIEW'
+) ON CONFLICT DO NOTHING;
+
+-- Step 9: Create demo user for Demo Bank
+-- Email: demo@demobank.in
+-- Password: Demo@1234
+INSERT INTO users (
+    id, tenant_id, email, username, password_hash,
+    full_name, designation, department, is_active, is_email_verified
+) VALUES (
+    'c0000000-0000-0000-0000-000000000002',
+    'a0000000-0000-0000-0000-000000000002',
+    'demo@demobank.in',
+    'demo_credit',
+    '$2a$12$9k.GJjJDiZqSVhWNi3W4C.F.5XknZ3Nuo8hHE1t3L3XuoUgJAOxFW',
+    'Demo Credit Manager',
+    'Credit Manager',
+    'Credit Department',
+    TRUE, TRUE
+) ON CONFLICT (tenant_id, email) DO NOTHING;
+
+-- Step 10: Assign CREDIT_MANAGER role to demo user
+INSERT INTO user_roles (user_id, role_id)
+VALUES (
+    'c0000000-0000-0000-0000-000000000002',
+    'b0000000-0000-0000-0000-000000000002'
+) ON CONFLICT DO NOTHING;
+
+-- Step 11: Seed rule categories for Demo Bank
+INSERT INTO rule_categories (id, tenant_id, category_code, category_name, icon, sort_order, is_active)
+VALUES
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'ELIGIBILITY', 'Eligibility Rules', '✅', 1, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'BUREAU', 'Bureau Rules', '📊', 2, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'INCOME', 'Income Rules', '💰', 3, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'VEHICLE', 'Vehicle Rules', '🚗', 4, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'FI', 'FI Rules', '🏠', 5, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'FRAUD', 'Fraud Rules', '🚨', 6, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'COMPLIANCE', 'Compliance Rules', '📋', 7, TRUE)
+ON CONFLICT DO NOTHING;
+
+-- Step 12: Seed loan stages for Demo Bank
+INSERT INTO loan_stages (id, tenant_id, stage_code, stage_name, stage_order, is_active)
+VALUES
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'LOGIN', 'Login Stage', 1, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'DEDUPE', 'De-Dupe Check', 2, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'BUREAU_PULL', 'Bureau Pull', 3, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'CREDIT_EVAL', 'Credit Evaluation', 4, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'FI', 'Field Investigation', 5, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'VALUATION', 'Vehicle Valuation', 6, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'FINAL_CREDIT', 'Final Credit Decision', 7, TRUE),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'SANCTION', 'Sanction', 8, TRUE)
+ON CONFLICT DO NOTHING;
+
+-- Step 13: Seed products for Demo Bank
+INSERT INTO products (id, tenant_id, product_code, product_name, product_type, is_active, config)
+VALUES
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'VL', 'Vehicle Loan', 'VEHICLE_LOAN', TRUE, '{}'::jsonb),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'TL', 'Tractor Loan', 'TRACTOR_LOAN', TRUE, '{}'::jsonb),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'AL', 'Auto Loan', 'AUTO_LOAN', TRUE, '{}'::jsonb),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'CVL', 'Commercial Vehicle Loan', 'CV_LOAN', TRUE, '{}'::jsonb),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'MSME', 'MSME Loan', 'MSME', TRUE, '{}'::jsonb),
+    (uuid_generate_v4(), 'a0000000-0000-0000-0000-000000000002', 'PL', 'Personal Loan', 'PERSONAL_LOAN', TRUE, '{}'::jsonb)
+ON CONFLICT DO NOTHING;
+
+-- ============================================================
+-- VERIFICATION QUERIES (run to confirm seed data)
+-- ============================================================
+-- SELECT * FROM tenants;
+-- SELECT u.email, u.full_name, r.role_name FROM users u
+--   JOIN user_roles ur ON ur.user_id = u.id
+--   JOIN roles r ON r.id = ur.role_id;
+-- SELECT COUNT(*) FROM permissions;

01_schema.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# ==============================================================
+# OPTIM AI BRE Engine — PostgreSQL First-Run Init Script
+# Runs automatically when the postgres volume is empty.
+# Applies schema + seed data in order.
+# ==============================================================
+set -e
+
+echo "================================================"
+echo "OPTIM AI BRE — Initializing PostgreSQL schema..."
+echo "================================================"
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+
+    -- Enable required extensions
+    CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+    CREATE EXTENSION IF NOT EXISTS "pgcrypto";
+    CREATE EXTENSION IF NOT EXISTS "pg_trgm";
+
+EOSQL
+
+echo "Extensions created. Running migration 001..."
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+    -f /docker-entrypoint-initdb.d/migrations/001_initial_schema.sql
+
+echo "Running migration 002 (seed data)..."
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
+    -f /docker-entrypoint-initdb.d/migrations/002_seed_admin.sql
+
+echo "================================================"
+echo "Database initialization complete!"
+echo "Admin login: admin@optimai.in / Admin@1234"
+echo "Demo login:  demo@demobank.in / Demo@1234"
+echo "================================================"

ActionEditor.tsx

@@ -0,0 +1,208 @@
+'use client'
+
+import React from 'react'
+import type { RuleAction, ActionType, Decision, RiskCategory, TrafficLight, Severity } from '@/types'
+
+interface Props {
+  action: RuleAction
+  index: number
+  onChange: (action: RuleAction) => void
+  onDelete: () => void
+  readOnly?: boolean
+}
+
+const ACTION_CONFIGS: Record<ActionType, {
+  label: string
+  icon: string
+  color: string
+  valueType: 'decision' | 'risk' | 'traffic_light' | 'text' | 'deviation' | 'score'
+  description: string
+}> = {
+  SET_DECISION: {
+    label: 'Set Decision',
+    icon: '⚖️',
+    color: 'bg-red-50 border-red-200',
+    valueType: 'decision',
+    description: 'Sets the final loan decision',
+  },
+  SET_RISK: {
+    label: 'Set Risk Level',
+    icon: '⚠️',
+    color: 'bg-yellow-50 border-yellow-200',
+    valueType: 'risk',
+    description: 'Sets the risk category',
+  },
+  SET_TRAFFIC_LIGHT: {
+    label: 'Set Traffic Light',
+    icon: '🚦',
+    color: 'bg-green-50 border-green-200',
+    valueType: 'traffic_light',
+    description: 'Sets the visual status indicator',
+  },
+  ADD_DEVIATION: {
+    label: 'Add Deviation',
+    icon: '📋',
+    color: 'bg-orange-50 border-orange-200',
+    valueType: 'deviation',
+    description: 'Flags a policy deviation',
+  },
+  SET_FIELD: {
+    label: 'Set Output Field',
+    icon: '📝',
+    color: 'bg-blue-50 border-blue-200',
+    valueType: 'text',
+    description: 'Sets a custom output field value',
+  },
+  ADD_TAG: {
+    label: 'Add Tag',
+    icon: '🏷️',
+    color: 'bg-purple-50 border-purple-200',
+    valueType: 'text',
+    description: 'Adds a tag to the decision',
+  },
+  SET_SCORE: {
+    label: 'Set Risk Score',
+    icon: '📊',
+    color: 'bg-teal-50 border-teal-200',
+    valueType: 'score',
+    description: 'Sets or adjusts the risk score (0-100)',
+  },
+}
+
+export function ActionEditor({ action, index, onChange, onDelete, readOnly }: Props) {
+  const config = ACTION_CONFIGS[action.type]
+
+  return (
+    <div className={`flex items-center gap-3 rounded-xl border-2 p-3 ${config.color}`}>
+      {/* Action Number */}
+      <div className="w-6 h-6 rounded-full bg-white border border-gray-200 flex items-center justify-center text-xs font-bold text-gray-500">
+        {index + 1}
+      </div>
+
+      {/* Icon */}
+      <span className="text-xl" role="img">{config.icon}</span>
+
+      {/* Type Selector */}
+      <select
+        disabled={readOnly}
+        value={action.type}
+        onChange={(e) => onChange({ ...action, type: e.target.value as ActionType, value: '' })}
+        className="text-sm font-medium border border-transparent bg-white/70 rounded-lg px-2 py-1 focus:outline-none focus:border-blue-400"
+      >
+        {Object.entries(ACTION_CONFIGS).map(([type, cfg]) => (
+          <option key={type} value={type}>{cfg.label}</option>
+        ))}
+      </select>
+
+      {/* Value Input */}
+      {config.valueType === 'decision' && (
+        <select
+          disabled={readOnly}
+          value={action.value ?? 'REJECT'}
+          onChange={(e) => onChange({ ...action, value: e.target.value })}
+          className="text-sm font-semibold border border-white/70 bg-white rounded-lg px-3 py-1 focus:outline-none focus:border-blue-400"
+        >
+          {(['APPROVE', 'REJECT', 'DEVIATION', 'REFER'] as Decision[]).map((d) => (
+            <option key={d} value={d}>{d}</option>
+          ))}
+        </select>
+      )}
+
+      {config.valueType === 'risk' && (
+        <select
+          disabled={readOnly}
+          value={action.value ?? 'HIGH'}
+          onChange={(e) => onChange({ ...action, value: e.target.value })}
+          className="text-sm font-semibold border border-white/70 bg-white rounded-lg px-3 py-1 focus:outline-none focus:border-blue-400"
+        >
+          {(['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'] as RiskCategory[]).map((r) => (
+            <option key={r} value={r}>{r}</option>
+          ))}
+        </select>
+      )}
+
+      {config.valueType === 'traffic_light' && (
+        <select
+          disabled={readOnly}
+          value={action.value ?? 'RED'}
+          onChange={(e) => onChange({ ...action, value: e.target.value })}
+          className="text-sm font-semibold border border-white/70 bg-white rounded-lg px-3 py-1 focus:outline-none focus:border-blue-400"
+        >
+          {(['GREEN', 'AMBER', 'RED'] as TrafficLight[]).map((t) => (
+            <option key={t} value={t}>{t}</option>
+          ))}
+        </select>
+      )}
+
+      {config.valueType === 'deviation' && (
+        <div className="flex gap-2 flex-1">
+          <input
+            disabled={readOnly}
+            value={action.value ?? ''}
+            onChange={(e) => onChange({ ...action, value: e.target.value })}
+            placeholder="Deviation code (e.g., LOW_BUREAU_SCORE)"
+            className="flex-1 text-sm border border-white/70 bg-white rounded-lg px-3 py-1 focus:outline-none focus:border-blue-400 font-mono"
+          />
+          <input
+            disabled={readOnly}
+            value={action.parameters?.severity ?? 'HIGH'}
+            onChange={(e) => onChange({ ...action, parameters: { ...action.parameters, severity: e.target.value } })}
+            placeholder="Severity"
+            className="w-24 text-sm border border-white/70 bg-white rounded-lg px-2 py-1 focus:outline-none focus:border-blue-400"
+          />
+        </div>
+      )}
+
+      {config.valueType === 'text' && (
+        <div className="flex gap-2 flex-1">
+          {action.type === 'SET_FIELD' && (
+            <input
+              disabled={readOnly}
+              value={action.field ?? ''}
+              onChange={(e) => onChange({ ...action, field: e.target.value })}
+              placeholder="Field name"
+              className="w-40 text-sm border border-white/70 bg-white rounded-lg px-2 py-1 focus:outline-none focus:border-blue-400 font-mono"
+            />
+          )}
+          <input
+            disabled={readOnly}
+            value={action.value ?? ''}
+            onChange={(e) => onChange({ ...action, value: e.target.value })}
+            placeholder={action.type === 'ADD_TAG' ? 'tag-name' : 'Value'}
+            className="flex-1 text-sm border border-white/70 bg-white rounded-lg px-3 py-1 focus:outline-none focus:border-blue-400"
+          />
+        </div>
+      )}
+
+      {config.valueType === 'score' && (
+        <div className="flex items-center gap-2">
+          <input
+            disabled={readOnly}
+            type="number"
+            min={-100}
+            max={100}
+            value={action.value ?? ''}
+            onChange={(e) => onChange({ ...action, value: e.target.value })}
+            placeholder="0–100 or +/-offset"
+            className="w-40 text-sm border border-white/70 bg-white rounded-lg px-3 py-1 focus:outline-none focus:border-blue-400"
+          />
+          <span className="text-xs text-gray-500">Prefix +/- for adjustment</span>
+        </div>
+      )}
+
+      {/* Description */}
+      <span className="text-xs text-gray-500 hidden xl:block">{config.description}</span>
+
+      {/* Delete */}
+      {!readOnly && (
+        <button
+          onClick={onDelete}
+          className="ml-auto text-gray-300 hover:text-red-500 transition-colors text-lg"
+          title="Delete action"
+        >
+          ✕
+        </button>
+      )}
+    </div>
+  )
+}

ActionExecutor.cs

@@ -0,0 +1,177 @@
+using Microsoft.Extensions.Logging;
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.Shared.Domain;
+
+namespace OptimAI.BRE.RuleEngine.Application;
+
+public sealed class ActionExecutor : IActionExecutor
+{
+    private readonly IDeviationTypeRepository _deviationTypeRepo;
+    private readonly ILogger<ActionExecutor> _logger;
+
+    public ActionExecutor(IDeviationTypeRepository deviationTypeRepo, ILogger<ActionExecutor> logger)
+    {
+        _deviationTypeRepo = deviationTypeRepo;
+        _logger = logger;
+    }
+
+    public async Task ExecuteAsync(RuleAction action, ExecutionContext context, RuleExecutionState state)
+    {
+        try
+        {
+            switch (action.Type)
+            {
+                case ActionType.SetDecision:
+                    ExecuteSetDecision(action, state);
+                    break;
+
+                case ActionType.SetRisk:
+                    ExecuteSetRisk(action, state);
+                    break;
+
+                case ActionType.SetTrafficLight:
+                    ExecuteSetTrafficLight(action, state);
+                    break;
+
+                case ActionType.AddDeviation:
+                    await ExecuteAddDeviationAsync(action, context, state);
+                    break;
+
+                case ActionType.SetField:
+                    ExecuteSetField(action, state);
+                    break;
+
+                case ActionType.AddTag:
+                    ExecuteAddTag(action, state);
+                    break;
+
+                case ActionType.SetScore:
+                    ExecuteSetScore(action, state);
+                    break;
+
+                default:
+                    _logger.LogWarning("Unknown action type: {ActionType}", action.Type);
+                    break;
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Action execution failed: {ActionType}", action.Type);
+        }
+    }
+
+    private static void ExecuteSetDecision(RuleAction action, RuleExecutionState state)
+    {
+        if (Enum.TryParse<Decision>(action.Value, true, out var decision))
+        {
+            // Higher severity decisions take priority: Reject > Deviation > Refer > Approve
+            var priority = new Dictionary<Decision, int>
+            {
+                [Decision.Reject] = 4,
+                [Decision.Deviation] = 3,
+                [Decision.Refer] = 2,
+                [Decision.Approve] = 1,
+                [Decision.Pending] = 0
+            };
+
+            if (priority.GetValueOrDefault(decision, 0) > priority.GetValueOrDefault(state.GlobalState.CurrentDecision, 0))
+            {
+                state.GlobalState.CurrentDecision = decision;
+
+                if (decision == Decision.Reject)
+                    state.GlobalState.ShouldStop = false; // Continue collecting all rejection reasons
+            }
+        }
+    }
+
+    private static void ExecuteSetRisk(RuleAction action, RuleExecutionState state)
+    {
+        if (Enum.TryParse<RiskCategory>(action.Value, true, out var risk))
+        {
+            // Escalate risk level only
+            var currentRisk = state.GlobalState.OutputFields.GetValueOrDefault("_riskCategory") as string;
+            if (currentRisk == null || ShouldEscalate(currentRisk, risk.ToString()))
+                state.GlobalState.OutputFields["_riskCategory"] = risk.ToString();
+        }
+    }
+
+    private static void ExecuteSetTrafficLight(RuleAction action, RuleExecutionState state)
+    {
+        if (Enum.TryParse<TrafficLight>(action.Value, true, out var tl))
+            state.GlobalState.TrafficLight = tl;
+    }
+
+    private async Task ExecuteAddDeviationAsync(RuleAction action, ExecutionContext context, RuleExecutionState state)
+    {
+        var deviationCode = action.Value ?? action.Parameters.GetValueOrDefault("code");
+        if (deviationCode == null) return;
+
+        var deviationType = await _deviationTypeRepo.FindByCodeAsync(context.TenantId, deviationCode);
+
+        var deviation = new ExecutionDeviation
+        {
+            TenantId = context.TenantId,
+            DeviationCode = deviationCode,
+            DeviationName = deviationType?.DeviationName ?? deviationCode,
+            Severity = deviationType?.DefaultSeverity ?? ParseSeverity(action.Parameters.GetValueOrDefault("severity")),
+            Reason = action.Parameters.GetValueOrDefault("reason") ?? deviationType?.Description ?? "Policy deviation detected",
+            FieldPath = action.Parameters.GetValueOrDefault("field"),
+            RecommendedAction = action.Parameters.GetValueOrDefault("action") ?? deviationType?.RecommendedAction,
+            DeviationTypeId = deviationType?.Id
+        };
+
+        // Resolve field values for context
+        if (deviation.FieldPath != null)
+        {
+            var val = context.Data.GetValue(deviation.FieldPath);
+            deviation.ActualValue = val?.ToString();
+        }
+
+        state.GlobalState.Deviations.Add(deviation);
+
+        // Automatically set decision to DEVIATION if not already REJECT
+        if (state.GlobalState.CurrentDecision != Decision.Reject)
+            state.GlobalState.CurrentDecision = Decision.Deviation;
+    }
+
+    private static void ExecuteSetField(RuleAction action, RuleExecutionState state)
+    {
+        if (action.Field != null)
+            state.GlobalState.OutputFields[action.Field] = action.Value ?? "";
+    }
+
+    private static void ExecuteAddTag(RuleAction action, RuleExecutionState state)
+    {
+        if (action.Value != null && !state.GlobalState.Tags.Contains(action.Value))
+            state.GlobalState.Tags.Add(action.Value);
+    }
+
+    private static void ExecuteSetScore(RuleAction action, RuleExecutionState state)
+    {
+        if (decimal.TryParse(action.Value, out var score))
+        {
+            // Score adjustments: can be absolute or relative (+10, -5)
+            if (action.Value!.StartsWith('+') || action.Value.StartsWith('-'))
+                state.GlobalState.RiskScore = Math.Clamp(state.GlobalState.RiskScore + score, 0, 100);
+            else
+                state.GlobalState.RiskScore = Math.Clamp(score, 0, 100);
+        }
+    }
+
+    private static bool ShouldEscalate(string current, string incoming)
+    {
+        var order = new[] { "Low", "Medium", "High", "Critical" };
+        var currentIdx = Array.IndexOf(order, current);
+        var incomingIdx = Array.IndexOf(order, incoming);
+        return incomingIdx > currentIdx;
+    }
+
+    private static Severity ParseSeverity(string? value) =>
+        Enum.TryParse<Severity>(value, true, out var s) ? s : Severity.Medium;
+}
+
+public interface IDeviationTypeRepository
+{
+    Task<DeviationType?> FindByCodeAsync(Guid tenantId, string code, CancellationToken ct = default);
+    Task<IReadOnlyList<DeviationType>> GetAllActiveAsync(Guid tenantId, CancellationToken ct = default);
+}

AiAnalystPanel.tsx

@@ -0,0 +1,244 @@
+'use client'
+
+import React, { useState } from 'react'
+import { useMutation } from '@tanstack/react-query'
+import type { AiAnalysis, BREDecisionResponse, Deviation } from '@/types'
+import { apiClient } from '@/lib/api-client'
+
+interface Props {
+  decision: BREDecisionResponse
+}
+
+export function AiAnalystPanel({ decision }: Props) {
+  const [aiResult, setAiResult] = useState<AiAnalysis | null>(decision.aiAnalysis ?? null)
+  const [activeSection, setActiveSection] = useState<string>('summary')
+
+  const analyze = useMutation({
+    mutationFn: () =>
+      apiClient.post('/ai/analyze-credit', {
+        applicationData: {},
+        decision: decision.decision,
+        riskScore: decision.riskScore,
+        riskCategory: decision.riskCategory,
+        deviations: [],
+      }) as Promise<AiAnalysis>,
+    onSuccess: setAiResult,
+  })
+
+  const sections = [
+    { id: 'summary', label: 'Risk Summary', icon: '📊' },
+    { id: 'credit', label: 'Credit Analysis', icon: '💳' },
+    { id: 'strengths', label: 'Strengths', icon: '💪' },
+    { id: 'weaknesses', label: 'Weaknesses', icon: '⚠️' },
+    { id: 'deviations', label: 'Deviations', icon: '📋' },
+    { id: 'docs', label: 'Documents Required', icon: '📂' },
+    { id: 'notes', label: 'Underwriting Notes', icon: '📝' },
+  ]
+
+  return (
+    <div className="bg-white rounded-xl border border-gray-200 overflow-hidden">
+      {/* Header */}
+      <div className="bg-gradient-to-r from-violet-600 to-purple-700 px-6 py-4">
+        <div className="flex items-center justify-between">
+          <div className="flex items-center gap-3">
+            <div className="w-10 h-10 rounded-xl bg-white/20 flex items-center justify-center text-xl">🤖</div>
+            <div>
+              <h2 className="text-white font-bold text-lg">OPTIM AI Credit Analyst</h2>
+              <p className="text-purple-200 text-sm">AI-powered credit risk assessment</p>
+            </div>
+          </div>
+          {!aiResult && (
+            <button
+              onClick={() => analyze.mutate()}
+              disabled={analyze.isPending}
+              className="px-4 py-2 bg-white text-purple-700 rounded-lg text-sm font-semibold hover:bg-purple-50 transition-colors disabled:opacity-60"
+            >
+              {analyze.isPending ? '⏳ Analyzing...' : '✨ Run AI Analysis'}
+            </button>
+          )}
+          {aiResult && (
+            <div className="flex items-center gap-2">
+              <div className="text-white/70 text-sm">Confidence:</div>
+              <div className="text-white font-bold">{Math.round(aiResult.confidenceScore * 100)}%</div>
+            </div>
+          )}
+        </div>
+      </div>
+
+      {/* Decision Summary Bar */}
+      <div className={`px-6 py-3 flex items-center gap-6 ${
+        decision.decision === 'APPROVE' ? 'bg-emerald-50 border-b border-emerald-100' :
+        decision.decision === 'REJECT' ? 'bg-red-50 border-b border-red-100' :
+        'bg-amber-50 border-b border-amber-100'
+      }`}>
+        <TrafficLightIndicator light={decision.trafficLight} />
+        <div className="flex gap-6 text-sm">
+          <div>
+            <span className="text-gray-500">Decision:</span>
+            <span className={`ml-2 font-bold ${
+              decision.decision === 'APPROVE' ? 'text-emerald-700' :
+              decision.decision === 'REJECT' ? 'text-red-700' : 'text-amber-700'
+            }`}>{decision.decision}</span>
+          </div>
+          <div>
+            <span className="text-gray-500">Risk Score:</span>
+            <span className="ml-2 font-bold text-gray-800">{decision.riskScore.toFixed(1)}/100</span>
+          </div>
+          <div>
+            <span className="text-gray-500">Risk:</span>
+            <RiskBadge category={decision.riskCategory} />
+          </div>
+          <div>
+            <span className="text-gray-500">Rules:</span>
+            <span className="ml-2 font-bold text-gray-800">
+              {decision.rulesPassed}/{decision.totalRulesEvaluated} matched
+            </span>
+          </div>
+          <div>
+            <span className="text-gray-500">Deviations:</span>
+            <span className="ml-2 font-bold text-amber-700">{decision.deviationsCount}</span>
+          </div>
+          <div>
+            <span className="text-gray-500">Time:</span>
+            <span className="ml-2 font-bold text-gray-800">{decision.executionMs}ms</span>
+          </div>
+        </div>
+      </div>
+
+      {aiResult ? (
+        <div className="flex h-[500px]">
+          {/* Sidebar Nav */}
+          <div className="w-48 bg-gray-50 border-r border-gray-100 py-4">
+            {sections.map((s) => (
+              <button
+                key={s.id}
+                onClick={() => setActiveSection(s.id)}
+                className={`w-full flex items-center gap-2 px-4 py-2.5 text-sm text-left transition-colors ${
+                  activeSection === s.id
+                    ? 'bg-violet-50 text-violet-700 font-semibold border-r-2 border-violet-600'
+                    : 'text-gray-600 hover:bg-gray-100'
+                }`}
+              >
+                <span>{s.icon}</span>
+                <span>{s.label}</span>
+              </button>
+            ))}
+          </div>
+
+          {/* Content */}
+          <div className="flex-1 overflow-auto p-6">
+            {activeSection === 'summary' && (
+              <AiSection title="Risk Summary" icon="📊" content={aiResult.riskSummary} />
+            )}
+            {activeSection === 'credit' && (
+              <AiSection title="Credit Summary" icon="💳" content={aiResult.creditSummary} />
+            )}
+            {activeSection === 'strengths' && (
+              <ListSection title="Customer Strengths" icon="💪" items={aiResult.strengths} variant="success" />
+            )}
+            {activeSection === 'weaknesses' && (
+              <ListSection title="Customer Weaknesses" icon="⚠️" items={aiResult.weaknesses} variant="warning" />
+            )}
+            {activeSection === 'deviations' && (
+              <div>
+                <AiSection title="Deviation Summary" icon="📋" content={aiResult.deviationsSummary} />
+                {aiResult.rejectionReasons.length > 0 && (
+                  <div className="mt-4">
+                    <ListSection title="Rejection Reasons" icon="🚫" items={aiResult.rejectionReasons} variant="error" />
+                  </div>
+                )}
+              </div>
+            )}
+            {activeSection === 'docs' && (
+              <ListSection title="Additional Documents Required" icon="📂" items={aiResult.additionalDocuments} variant="info" />
+            )}
+            {activeSection === 'notes' && (
+              <AiSection title="Underwriting Notes" icon="📝" content={aiResult.underwritingNotes} />
+            )}
+          </div>
+        </div>
+      ) : (
+        <div className="flex flex-col items-center justify-center py-16 text-gray-400">
+          <div className="text-5xl mb-4">🤖</div>
+          <p className="text-lg font-medium text-gray-500">AI Analysis Not Yet Run</p>
+          <p className="text-sm mt-1">Click "Run AI Analysis" to get comprehensive credit insights</p>
+        </div>
+      )}
+    </div>
+  )
+}
+
+function AiSection({ title, icon, content }: { title: string; icon: string; content: string }) {
+  return (
+    <div>
+      <h3 className="flex items-center gap-2 text-base font-semibold text-gray-800 mb-3">
+        <span>{icon}</span> {title}
+      </h3>
+      <div className="bg-gray-50 rounded-xl p-4 text-sm text-gray-700 leading-relaxed whitespace-pre-wrap">
+        {content || <span className="text-gray-400 italic">No content available</span>}
+      </div>
+    </div>
+  )
+}
+
+function ListSection({
+  title, icon, items, variant
+}: {
+  title: string; icon: string; items: string[]; variant: 'success' | 'warning' | 'error' | 'info'
+}) {
+  const styles = {
+    success: { dot: 'bg-emerald-500', bg: 'bg-emerald-50', border: 'border-emerald-100' },
+    warning: { dot: 'bg-amber-500', bg: 'bg-amber-50', border: 'border-amber-100' },
+    error: { dot: 'bg-red-500', bg: 'bg-red-50', border: 'border-red-100' },
+    info: { dot: 'bg-blue-500', bg: 'bg-blue-50', border: 'border-blue-100' },
+  }[variant]
+
+  return (
+    <div>
+      <h3 className="flex items-center gap-2 text-base font-semibold text-gray-800 mb-3">
+        <span>{icon}</span> {title}
+      </h3>
+      {items.length === 0 ? (
+        <p className="text-gray-400 text-sm italic">None identified</p>
+      ) : (
+        <div className={`rounded-xl border ${styles.border} ${styles.bg} p-4 space-y-2`}>
+          {items.map((item, idx) => (
+            <div key={idx} className="flex items-start gap-2">
+              <div className={`w-2 h-2 rounded-full ${styles.dot} mt-1.5 flex-shrink-0`} />
+              <span className="text-sm text-gray-700">{item}</span>
+            </div>
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}
+
+function TrafficLightIndicator({ light }: { light: string }) {
+  return (
+    <div className="flex items-center gap-1.5">
+      {(['GREEN', 'AMBER', 'RED'] as const).map((l) => (
+        <div
+          key={l}
+          className={`w-4 h-4 rounded-full transition-all ${
+            l === light
+              ? l === 'GREEN' ? 'bg-emerald-500 shadow-lg shadow-emerald-200' :
+                l === 'AMBER' ? 'bg-amber-500 shadow-lg shadow-amber-200' :
+                'bg-red-500 shadow-lg shadow-red-200'
+              : 'bg-gray-200'
+          }`}
+        />
+      ))}
+    </div>
+  )
+}
+
+function RiskBadge({ category }: { category: string }) {
+  const colors: Record<string, string> = {
+    LOW: 'ml-2 px-2 py-0.5 bg-emerald-100 text-emerald-700 rounded text-xs font-semibold',
+    MEDIUM: 'ml-2 px-2 py-0.5 bg-blue-100 text-blue-700 rounded text-xs font-semibold',
+    HIGH: 'ml-2 px-2 py-0.5 bg-orange-100 text-orange-700 rounded text-xs font-semibold',
+    CRITICAL: 'ml-2 px-2 py-0.5 bg-red-100 text-red-700 rounded text-xs font-semibold',
+  }
+  return <span className={colors[category] ?? colors.MEDIUM}>{category}</span>
+}

AiController.cs

@@ -0,0 +1,231 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using OptimAI.BRE.AIEngine.Application;
+using OptimAI.BRE.RuleEngine.Api;
+using OptimAI.BRE.Shared.Domain;
+
+namespace OptimAI.BRE.AIEngine.Api;
+
+[ApiController]
+[Route("api/v1/ai")]
+[Authorize]
+public sealed class AiController : ControllerBase
+{
+    private readonly IAiCreditAnalystService _aiService;
+    private readonly IAiRuleGeneratorRepository _generatedRuleRepo;
+    private readonly ITenantContextAccessor _tenantAccessor;
+    private readonly IFieldCatalogRepository _fieldCatalogRepo;
+    private readonly ILogger<AiController> _logger;
+
+    public AiController(
+        IAiCreditAnalystService aiService,
+        IAiRuleGeneratorRepository generatedRuleRepo,
+        ITenantContextAccessor tenantAccessor,
+        IFieldCatalogRepository fieldCatalogRepo,
+        ILogger<AiController> logger)
+    {
+        _aiService = aiService;
+        _generatedRuleRepo = generatedRuleRepo;
+        _tenantAccessor = tenantAccessor;
+        _fieldCatalogRepo = fieldCatalogRepo;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Generate BRE rule from natural language description using AI.
+    /// </summary>
+    [HttpPost("generate-rule")]
+    [Authorize(Policy = "AiGenerate")]
+    [ProducesResponseType(typeof(GeneratedRuleResponse), 200)]
+    public async Task<IActionResult> GenerateRule([FromBody] GenerateRuleRequest request, CancellationToken ct)
+    {
+        var availableFields = await _fieldCatalogRepo.GetFieldPathsAsync(_tenantAccessor.TenantId, ct);
+
+        var ruleDefinition = await _aiService.GenerateRuleFromPromptAsync(new RuleGenerationRequest
+        {
+            UserPrompt = request.Prompt,
+            ProductType = request.ProductType,
+            AvailableFields = availableFields,
+            TenantId = _tenantAccessor.TenantId,
+            CreatedBy = _tenantAccessor.UserId
+        }, ct);
+
+        if (ruleDefinition == null)
+            return BadRequest(new { error = "AI could not generate a rule from the provided description. Please be more specific." });
+
+        var savedId = await _generatedRuleRepo.SaveGeneratedRuleAsync(new AiGeneratedRuleRecord
+        {
+            TenantId = _tenantAccessor.TenantId,
+            UserPrompt = request.Prompt,
+            GeneratedRule = ruleDefinition,
+            CreatedBy = _tenantAccessor.UserId
+        }, ct);
+
+        return Ok(new GeneratedRuleResponse
+        {
+            GenerationId = savedId,
+            UserPrompt = request.Prompt,
+            RuleDefinition = ruleDefinition,
+            CanEdit = true,
+            Message = "Rule generated successfully. Review and save to rule engine."
+        });
+    }
+
+    /// <summary>
+    /// Run AI credit analysis on execution result.
+    /// </summary>
+    [HttpPost("analyze-credit")]
+    [Authorize(Policy = "AiAnalysis")]
+    [ProducesResponseType(typeof(AiAnalysis), 200)]
+    public async Task<IActionResult> AnalyzeCredit([FromBody] CreditAnalysisApiRequest request, CancellationToken ct)
+    {
+        var analysis = await _aiService.AnalyzeCreditAsync(new CreditAnalysisRequest
+        {
+            Data = request.ApplicationData,
+            Decision = request.Decision,
+            RiskScore = request.RiskScore,
+            RiskCategory = request.RiskCategory,
+            ProductCode = request.ProductCode,
+            Deviations = request.Deviations.Select(d => new ExecutionDeviation
+            {
+                DeviationCode = d.Code,
+                DeviationName = d.Name,
+                Severity = Enum.Parse<Severity>(d.Severity, true),
+                Reason = d.Reason
+            }).ToList()
+        }, ct);
+
+        return Ok(analysis);
+    }
+
+    /// <summary>
+    /// Analyze deviations and provide mitigation recommendations.
+    /// </summary>
+    [HttpPost("analyze-deviations")]
+    [Authorize(Policy = "AiAnalysis")]
+    [ProducesResponseType(typeof(DeviationAnalysis), 200)]
+    public async Task<IActionResult> AnalyzeDeviations([FromBody] DeviationAnalysisApiRequest request, CancellationToken ct)
+    {
+        var analysis = await _aiService.AnalyzeDeviationsAsync(new DeviationAnalysisRequest
+        {
+            ApplicationData = request.ApplicationData,
+            Deviations = request.Deviations.Select(d => new ExecutionDeviation
+            {
+                DeviationCode = d.Code,
+                DeviationName = d.Name,
+                Severity = Enum.Parse<Severity>(d.Severity, true),
+                Reason = d.Reason,
+                ActualValue = d.ActualValue,
+                ExpectedValue = d.ExpectedValue,
+                TenantId = _tenantAccessor.TenantId
+            }).ToList()
+        }, ct);
+
+        return Ok(analysis);
+    }
+
+    /// <summary>
+    /// Accept a generated rule and save to rule engine.
+    /// </summary>
+    [HttpPost("generated-rules/{generationId:guid}/accept")]
+    [Authorize(Policy = "RuleWrite")]
+    public async Task<IActionResult> AcceptGeneratedRule(Guid generationId, [FromBody] AcceptRuleRequest request, CancellationToken ct)
+    {
+        var saved = await _generatedRuleRepo.AcceptRuleAsync(generationId, _tenantAccessor.TenantId, request.CategoryId, _tenantAccessor.UserId, ct);
+        if (!saved) return NotFound();
+
+        return Ok(new { message = "Rule saved to rule engine successfully", ruleId = saved });
+    }
+
+    /// <summary>
+    /// Get AI generation history.
+    /// </summary>
+    [HttpGet("generated-rules")]
+    [ProducesResponseType(typeof(List<AiGeneratedRuleRecord>), 200)]
+    public async Task<IActionResult> GetGenerationHistory([FromQuery] int page = 1, [FromQuery] int pageSize = 20, CancellationToken ct = default)
+    {
+        var history = await _generatedRuleRepo.GetHistoryAsync(_tenantAccessor.TenantId, page, pageSize, ct);
+        return Ok(history);
+    }
+}
+
+// DTOs
+public record GenerateRuleRequest
+{
+    public string Prompt { get; init; } = default!;
+    public string? ProductType { get; init; }
+}
+
+public record GeneratedRuleResponse
+{
+    public Guid GenerationId { get; init; }
+    public string UserPrompt { get; init; } = default!;
+    public RuleDefinition RuleDefinition { get; init; } = default!;
+    public bool CanEdit { get; init; }
+    public string Message { get; init; } = default!;
+}
+
+public record CreditAnalysisApiRequest
+{
+    public Dictionary<string, object> ApplicationData { get; init; } = new();
+    public string Decision { get; init; } = default!;
+    public decimal RiskScore { get; init; }
+    public string RiskCategory { get; init; } = default!;
+    public string? ProductCode { get; init; }
+    public List<DeviationDto> Deviations { get; init; } = new();
+}
+
+public record DeviationAnalysisApiRequest
+{
+    public Dictionary<string, object> ApplicationData { get; init; } = new();
+    public List<DeviationDto> Deviations { get; init; } = new();
+}
+
+public record DeviationDto
+{
+    public string Code { get; init; } = default!;
+    public string Name { get; init; } = default!;
+    public string Severity { get; init; } = default!;
+    public string Reason { get; init; } = default!;
+    public string? ActualValue { get; init; }
+    public string? ExpectedValue { get; init; }
+}
+
+public record AcceptRuleRequest
+{
+    public Guid? CategoryId { get; init; }
+}
+
+public class AiGeneratedRuleRecord
+{
+    public Guid Id { get; set; }
+    public Guid TenantId { get; set; }
+    public string UserPrompt { get; set; } = default!;
+    public RuleDefinition GeneratedRule { get; set; } = default!;
+    public Guid? RuleId { get; set; }
+    public bool? IsAccepted { get; set; }
+    public Guid CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+}
+
+public interface IAiRuleGeneratorRepository
+{
+    Task<Guid> SaveGeneratedRuleAsync(AiGeneratedRuleRecord record, CancellationToken ct = default);
+    Task<bool> AcceptRuleAsync(Guid generationId, Guid tenantId, Guid? categoryId, Guid userId, CancellationToken ct = default);
+    Task<List<AiGeneratedRuleRecord>> GetHistoryAsync(Guid tenantId, int page, int pageSize, CancellationToken ct = default);
+}
+
+public interface IFieldCatalogRepository
+{
+    Task<List<string>> GetFieldPathsAsync(Guid tenantId, CancellationToken ct = default);
+    Task<List<FieldCatalogDto>> GetCatalogAsync(Guid tenantId, string? category = null, CancellationToken ct = default);
+}
+
+public record FieldCatalogDto
+{
+    public string FieldPath { get; init; } = default!;
+    public string DisplayName { get; init; } = default!;
+    public string DataType { get; init; } = default!;
+    public string? Category { get; init; }
+    public string? Description { get; init; }
+}

AppShell.tsx

@@ -0,0 +1,90 @@
+'use client'
+
+import React, { useState } from 'react'
+import Link from 'next/link'
+import { usePathname } from 'next/navigation'
+
+const NAV_ITEMS = [
+  { href: '/', label: 'Dashboard', icon: '📊' },
+  { href: '/rules', label: 'Rule Designer', icon: '⚙️' },
+  { href: '/rule-sets', label: 'Rule Sets', icon: '📦' },
+  { href: '/sandbox', label: 'Sandbox', icon: '🧪' },
+  { href: '/decisions', label: 'Decisions', icon: '⚖️' },
+  { href: '/deviations', label: 'Deviations', icon: '⚠️' },
+  { href: '/ai-rules', label: 'AI Rule Creator', icon: '🤖' },
+  { href: '/marketplace', label: 'Marketplace', icon: '🛒' },
+  { href: '/clients', label: 'Clients', icon: '🏢' },
+  { href: '/reports', label: 'Reports', icon: '📄' },
+  { href: '/audit', label: 'Audit Trail', icon: '🔍' },
+  { href: '/settings', label: 'Settings', icon: '🔧' },
+]
+
+export function AppShell({ children }: { children: React.ReactNode }) {
+  const pathname = usePathname()
+  const [collapsed, setCollapsed] = useState(false)
+
+  // Don't show shell on login page
+  if (pathname === '/login') return <>{children}</>
+
+  return (
+    <div className="flex h-screen bg-gray-50 overflow-hidden">
+      {/* Sidebar */}
+      <aside className={`${collapsed ? 'w-16' : 'w-56'} flex flex-col bg-gray-900 text-white transition-all duration-200 flex-shrink-0`}>
+        {/* Logo */}
+        <div className="flex items-center gap-3 px-4 py-5 border-b border-gray-700">
+          <div className="w-8 h-8 rounded-lg bg-blue-500 flex items-center justify-center text-sm font-black">O</div>
+          {!collapsed && (
+            <div>
+              <div className="text-sm font-bold leading-tight">OPTIM AI</div>
+              <div className="text-xs text-gray-400">BRE Engine</div>
+            </div>
+          )}
+          <button
+            onClick={() => setCollapsed(!collapsed)}
+            className="ml-auto text-gray-400 hover:text-white text-xs"
+          >
+            {collapsed ? '▶' : '◀'}
+          </button>
+        </div>
+
+        {/* Nav Items */}
+        <nav className="flex-1 py-4 overflow-y-auto">
+          {NAV_ITEMS.map(({ href, label, icon }) => {
+            const isActive = pathname === href || (href !== '/' && pathname.startsWith(href))
+            return (
+              <Link
+                key={href}
+                href={href}
+                className={`flex items-center gap-3 px-4 py-2.5 mx-2 rounded-lg transition-colors text-sm ${
+                  isActive
+                    ? 'bg-blue-600 text-white font-medium'
+                    : 'text-gray-400 hover:bg-gray-800 hover:text-white'
+                }`}
+                title={collapsed ? label : undefined}
+              >
+                <span className="text-base flex-shrink-0">{icon}</span>
+                {!collapsed && <span>{label}</span>}
+              </Link>
+            )
+          })}
+        </nav>
+
+        {/* Footer */}
+        <div className="border-t border-gray-700 px-4 py-3">
+          {!collapsed && (
+            <div className="flex items-center gap-2">
+              <div className="w-7 h-7 rounded-full bg-blue-500 flex items-center justify-center text-xs font-bold">A</div>
+              <div>
+                <div className="text-xs font-medium text-white">Admin User</div>
+                <div className="text-xs text-gray-400">Super Admin</div>
+              </div>
+            </div>
+          )}
+        </div>
+      </aside>
+
+      {/* Main Content */}
+      <main className="flex-1 overflow-auto">{children}</main>
+    </div>
+  )
+}

AuthController.cs

@@ -0,0 +1,234 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.IdentityModel.Tokens;
+using OptimAI.BRE.RuleEngine.Infrastructure;
+using OptimAI.BRE.Shared.Domain;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace OptimAI.BRE.IdentityService.Api;
+
+[ApiController]
+[Route("api/v1/auth")]
+public sealed class AuthController : ControllerBase
+{
+    private readonly BREDbContext _db;
+    private readonly JwtOptions _jwt;
+    private readonly ILogger<AuthController> _logger;
+
+    public AuthController(BREDbContext db, IOptions<JwtOptions> jwt, ILogger<AuthController> logger)
+    {
+        _db = db;
+        _jwt = jwt.Value;
+        _logger = logger;
+    }
+
+    [HttpPost("login")]
+    [ProducesResponseType(typeof(LoginResponse), 200)]
+    [ProducesResponseType(typeof(ProblemDetails), 401)]
+    public async Task<IActionResult> Login([FromBody] LoginRequest request, CancellationToken ct)
+    {
+        var user = await _db.Users
+            .Include(u => u.UserRoles)
+                .ThenInclude(ur => ur.Role)
+                    .ThenInclude(r => r.RolePermissions)
+                        .ThenInclude(rp => rp.Permission)
+            .FirstOrDefaultAsync(u =>
+                u.Email == request.Email.ToLower() &&
+                u.IsActive, ct);
+
+        if (user == null || !VerifyPassword(request.Password, user.PasswordHash))
+        {
+            if (user != null)
+            {
+                user.FailedLoginCount++;
+                if (user.FailedLoginCount >= 5)
+                    user.LockedUntil = DateTime.UtcNow.AddMinutes(30);
+                await _db.SaveChangesAsync(ct);
+            }
+            return Unauthorized(new { error = "Invalid email or password" });
+        }
+
+        if (user.LockedUntil.HasValue && user.LockedUntil > DateTime.UtcNow)
+            return Unauthorized(new { error = "Account locked. Try again later." });
+
+        user.FailedLoginCount = 0;
+        user.LastLoginAt = DateTime.UtcNow;
+        user.LastLoginIp = HttpContext.Connection.RemoteIpAddress?.ToString();
+        await _db.SaveChangesAsync(ct);
+
+        var permissions = user.UserRoles
+            .SelectMany(ur => ur.Role.RolePermissions)
+            .Select(rp => rp.Permission.PermissionCode)
+            .Distinct()
+            .ToList();
+
+        var accessToken = GenerateAccessToken(user, permissions);
+        var refreshToken = GenerateRefreshToken();
+
+        _db.RefreshTokens.Add(new RefreshToken
+        {
+            UserId = user.Id,
+            TokenHash = HashToken(refreshToken),
+            ExpiresAt = DateTime.UtcNow.AddDays(_jwt.RefreshTokenExpiryDays),
+            IpAddress = user.LastLoginIp,
+            UserAgent = Request.Headers.UserAgent.ToString()
+        });
+        await _db.SaveChangesAsync(ct);
+
+        return Ok(new LoginResponse
+        {
+            AccessToken = accessToken,
+            RefreshToken = refreshToken,
+            ExpiresIn = _jwt.AccessTokenExpiryMinutes * 60,
+            TokenType = "Bearer",
+            User = new UserDto
+            {
+                Id = user.Id,
+                Email = user.Email,
+                FullName = user.FullName,
+                TenantId = user.TenantId,
+                Permissions = permissions,
+                Roles = user.UserRoles.Select(ur => ur.Role.RoleCode).ToList()
+            }
+        });
+    }
+
+    [HttpPost("refresh")]
+    public async Task<IActionResult> Refresh([FromBody] RefreshRequest request, CancellationToken ct)
+    {
+        var hash = HashToken(request.RefreshToken);
+        var token = await _db.RefreshTokens
+            .Include(t => t.User)
+            .FirstOrDefaultAsync(t =>
+                t.TokenHash == hash &&
+                !t.IsRevoked &&
+                t.ExpiresAt > DateTime.UtcNow, ct);
+
+        if (token == null)
+            return Unauthorized(new { error = "Invalid or expired refresh token" });
+
+        // Rotate refresh token
+        token.IsRevoked = true;
+        var newRefreshToken = GenerateRefreshToken();
+        _db.RefreshTokens.Add(new RefreshToken
+        {
+            UserId = token.UserId,
+            TokenHash = HashToken(newRefreshToken),
+            ExpiresAt = DateTime.UtcNow.AddDays(_jwt.RefreshTokenExpiryDays)
+        });
+
+        await _db.SaveChangesAsync(ct);
+
+        var permissions = await GetUserPermissionsAsync(token.UserId, ct);
+        var accessToken = GenerateAccessToken(token.User!, permissions);
+
+        return Ok(new { accessToken, refreshToken = newRefreshToken });
+    }
+
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout([FromBody] LogoutRequest request, CancellationToken ct)
+    {
+        var hash = HashToken(request.RefreshToken);
+        await _db.RefreshTokens
+            .Where(t => t.TokenHash == hash)
+            .ExecuteUpdateAsync(s => s.SetProperty(t => t.IsRevoked, true), ct);
+        return Ok(new { message = "Logged out successfully" });
+    }
+
+    private string GenerateAccessToken(User user, List<string> permissions)
+    {
+        var claims = new List<Claim>
+        {
+            new(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
+            new(JwtRegisteredClaimNames.Email, user.Email),
+            new(JwtRegisteredClaimNames.Name, user.FullName),
+            new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
+            new("tenant_id", user.TenantId.ToString()),
+        };
+
+        foreach (var p in permissions)
+            claims.Add(new Claim("permission", p));
+
+        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_jwt.SecretKey));
+        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+
+        var token = new JwtSecurityToken(
+            issuer: _jwt.Issuer,
+            audience: _jwt.Audience,
+            claims: claims,
+            expires: DateTime.UtcNow.AddMinutes(_jwt.AccessTokenExpiryMinutes),
+            signingCredentials: creds);
+
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+
+    private static string GenerateRefreshToken()
+    {
+        var bytes = new byte[64];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+        return Convert.ToBase64String(bytes);
+    }
+
+    private static string HashToken(string token)
+    {
+        using var sha = SHA256.Create();
+        return Convert.ToHexString(sha.ComputeHash(Encoding.UTF8.GetBytes(token))).ToLower();
+    }
+
+    private static bool VerifyPassword(string password, string hash)
+        => BCrypt.Net.BCrypt.Verify(password, hash);
+
+    private async Task<List<string>> GetUserPermissionsAsync(Guid userId, CancellationToken ct)
+    {
+        return await _db.UserRoles
+            .Where(ur => ur.UserId == userId)
+            .SelectMany(ur => ur.Role.RolePermissions)
+            .Select(rp => rp.Permission.PermissionCode)
+            .Distinct()
+            .ToListAsync(ct);
+    }
+}
+
+// Models
+public class JwtOptions
+{
+    public string SecretKey { get; set; } = default!;
+    public string Issuer { get; set; } = default!;
+    public string Audience { get; set; } = default!;
+    public int AccessTokenExpiryMinutes { get; set; } = 60;
+    public int RefreshTokenExpiryDays { get; set; } = 30;
+}
+
+public record LoginRequest
+{
+    public string Email { get; init; } = default!;
+    public string Password { get; init; } = default!;
+    public bool RememberMe { get; init; }
+}
+
+public record LoginResponse
+{
+    public string AccessToken { get; init; } = default!;
+    public string RefreshToken { get; init; } = default!;
+    public int ExpiresIn { get; init; }
+    public string TokenType { get; init; } = "Bearer";
+    public UserDto User { get; init; } = default!;
+}
+
+public record UserDto
+{
+    public Guid Id { get; init; }
+    public string Email { get; init; } = default!;
+    public string FullName { get; init; } = default!;
+    public Guid TenantId { get; init; }
+    public List<string> Permissions { get; init; } = new();
+    public List<string> Roles { get; init; } = new();
+}
+
+public record RefreshRequest { public string RefreshToken { get; init; } = default!; }
+public record LogoutRequest { public string RefreshToken { get; init; } = default!; }

BREController.cs

@@ -0,0 +1,429 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using OptimAI.BRE.RuleEngine.Application;
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.Shared.Domain;
+using System.ComponentModel.DataAnnotations;
+
+namespace OptimAI.BRE.RuleEngine.Api;
+
+[ApiController]
+[Route("api/v1")]
+[Authorize]
+public sealed class BREController : ControllerBase
+{
+    private readonly IRuleExecutionService _executionService;
+    private readonly IExecutionRequestRepository _requestRepo;
+    private readonly IExecutionResultRepository _resultRepo;
+    private readonly ISandboxService _sandboxService;
+    private readonly IDecisionReportService _reportService;
+    private readonly ITenantContextAccessor _tenantAccessor;
+    private readonly ILogger<BREController> _logger;
+
+    public BREController(
+        IRuleExecutionService executionService,
+        IExecutionRequestRepository requestRepo,
+        IExecutionResultRepository resultRepo,
+        ISandboxService sandboxService,
+        IDecisionReportService reportService,
+        ITenantContextAccessor tenantAccessor,
+        ILogger<BREController> logger)
+    {
+        _executionService = executionService;
+        _requestRepo = requestRepo;
+        _resultRepo = resultRepo;
+        _sandboxService = sandboxService;
+        _reportService = reportService;
+        _tenantAccessor = tenantAccessor;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Execute BRE rules against provided JSON payload. Core decision API.
+    /// </summary>
+    [HttpPost("execute-bre")]
+    [EnableRateLimiting("bre-execution")]
+    [ProducesResponseType(typeof(BREDecisionResponse), 200)]
+    [ProducesResponseType(typeof(ProblemDetails), 400)]
+    [ProducesResponseType(typeof(ProblemDetails), 429)]
+    public async Task<IActionResult> ExecuteBre(
+        [FromBody] BREExecutionRequest request,
+        CancellationToken ct)
+    {
+        var tenantId = _tenantAccessor.TenantId;
+
+        var executionRequest = new ExecutionRequest
+        {
+            TenantId = tenantId,
+            CorrelationId = request.CorrelationId ?? Guid.NewGuid().ToString(),
+            ApplicationId = request.ApplicationId,
+            ProductCode = request.ProductCode,
+            BranchCode = request.BranchCode,
+            StageCode = request.StageCode,
+            RuleSetId = request.RuleSetId,
+            InputPayload = request.Data,
+            SourceSystem = request.SourceSystem,
+            Status = ExecutionStatus.Processing,
+            ProcessingStartedAt = DateTime.UtcNow
+        };
+
+        executionRequest = await _requestRepo.CreateAsync(executionRequest, ct);
+
+        var context = new ExecutionContext
+        {
+            TenantId = tenantId,
+            CorrelationId = executionRequest.CorrelationId,
+            ApplicationId = request.ApplicationId,
+            ProductCode = request.ProductCode,
+            BranchCode = request.BranchCode,
+            StageCode = request.StageCode,
+            RuleSetId = request.RuleSetId,
+            Data = new DynamicDataContext(request.Data),
+            Options = new ExecutionOptions
+            {
+                EnableAiAnalysis = request.EnableAiAnalysis ?? true,
+                EnableRiskScoring = true,
+                StopOnFirstReject = false,
+                TimeoutMs = 5000
+            }
+        };
+
+        var result = await _executionService.ExecuteAsync(context, ct);
+        result.RequestId = executionRequest.Id;
+
+        await _resultRepo.SaveAsync(result, ct);
+        await _requestRepo.MarkCompletedAsync(executionRequest.Id, ct);
+
+        var report = await _reportService.GenerateAsync(executionRequest.Id, result, ct);
+
+        return Ok(new BREDecisionResponse
+        {
+            RequestId = executionRequest.Id,
+            CorrelationId = executionRequest.CorrelationId!,
+            ApplicationId = request.ApplicationId,
+            Decision = result.FinalDecision.ToString(),
+            TrafficLight = result.TrafficLight?.ToString() ?? "AMBER",
+            RiskScore = result.RiskScore ?? 0,
+            RiskCategory = result.RiskCategory?.ToString() ?? "MEDIUM",
+            TotalRulesEvaluated = result.TotalRulesEvaluated,
+            RulesPassed = result.RulesPassed,
+            RulesFailed = result.RulesFailed,
+            DeviationsCount = result.DeviationsCount,
+            ExecutionMs = result.ExecutionMs ?? 0,
+            RuleResults = result.RuleResults.Select(r => new RuleResultDto
+            {
+                RuleCode = r.RuleCode,
+                RuleName = r.RuleName,
+                IsMatched = r.IsMatched,
+                ActionsExecuted = r.ActionsExecuted,
+                ExecutionMs = r.ExecutionMs ?? 0
+            }).ToList(),
+            AiSummary = result.AiSummary,
+            AiAnalysis = result.AiAnalysis != null ? new AiAnalysisDto
+            {
+                RiskSummary = result.AiAnalysis.RiskSummary,
+                CreditSummary = result.AiAnalysis.CreditSummary,
+                Strengths = result.AiAnalysis.Strengths,
+                Weaknesses = result.AiAnalysis.Weaknesses,
+                ApprovalRecommendation = result.AiAnalysis.ApprovalRecommendation,
+                RejectionReasons = result.AiAnalysis.RejectionReasons,
+                AdditionalDocuments = result.AiAnalysis.AdditionalDocuments,
+                UnderwritingNotes = result.AiAnalysis.UnderwritingNotes,
+                ConfidenceScore = result.AiAnalysis.ConfidenceScore
+            } : null,
+            ReportId = report?.Id,
+            GeneratedAt = DateTime.UtcNow
+        });
+    }
+
+    /// <summary>
+    /// Validate a rule definition before saving.
+    /// </summary>
+    [HttpPost("validate-rule")]
+    [Authorize(Policy = "RuleWrite")]
+    [ProducesResponseType(typeof(RuleValidationResponse), 200)]
+    public async Task<IActionResult> ValidateRule([FromBody] RuleValidationRequest request)
+    {
+        var errors = new List<string>();
+        var warnings = new List<string>();
+
+        // Validate rule definition structure
+        if (request.RuleDefinition == null)
+        {
+            errors.Add("Rule definition is required");
+            return Ok(new RuleValidationResponse { IsValid = false, Errors = errors });
+        }
+
+        if (request.RuleDefinition.Conditions == null || !request.RuleDefinition.Conditions.Rules.Any())
+            errors.Add("At least one condition is required");
+
+        if (!request.RuleDefinition.Actions.Any())
+            warnings.Add("Rule has no actions defined");
+
+        // Check referenced fields exist in catalog
+        var allFields = ExtractFieldPaths(request.RuleDefinition.Conditions);
+        foreach (var field in allFields)
+        {
+            if (!IsValidFieldPath(field))
+                warnings.Add($"Field '{field}' not found in field catalog");
+        }
+
+        // Test with sample data if provided
+        if (request.SampleData != null)
+        {
+            var context = new ExecutionContext
+            {
+                TenantId = _tenantAccessor.TenantId,
+                Data = new DynamicDataContext(request.SampleData),
+                Options = new ExecutionOptions { EnableAiAnalysis = false }
+            };
+
+            // Quick dry-run against sample data using the condition evaluator
+            // This validates conditions can be parsed and executed
+        }
+
+        return Ok(new RuleValidationResponse
+        {
+            IsValid = !errors.Any(),
+            Errors = errors,
+            Warnings = warnings,
+            ExtractedFields = allFields
+        });
+    }
+
+    /// <summary>
+    /// Simulate BRE execution without persisting results.
+    /// </summary>
+    [HttpPost("simulate-decision")]
+    [Authorize(Policy = "SandboxAccess")]
+    [ProducesResponseType(typeof(SimulationResponse), 200)]
+    public async Task<IActionResult> SimulateDecision([FromBody] SimulationRequest request, CancellationToken ct)
+    {
+        var result = await _sandboxService.SimulateAsync(new SandboxRequest
+        {
+            TenantId = _tenantAccessor.TenantId,
+            RuleSetId = request.RuleSetId,
+            TestData = request.Data,
+            RuleIds = request.RuleIds,
+            CreatedBy = _tenantAccessor.UserId
+        }, ct);
+
+        return Ok(result);
+    }
+
+    /// <summary>
+    /// Get execution result by request ID.
+    /// </summary>
+    [HttpGet("decisions/{requestId:guid}")]
+    [ProducesResponseType(typeof(BREDecisionResponse), 200)]
+    [ProducesResponseType(404)]
+    public async Task<IActionResult> GetDecision(Guid requestId, CancellationToken ct)
+    {
+        var result = await _resultRepo.GetByRequestIdAsync(requestId, _tenantAccessor.TenantId, ct);
+        if (result == null) return NotFound();
+        return Ok(result);
+    }
+
+    /// <summary>
+    /// Get decision history with pagination.
+    /// </summary>
+    [HttpGet("decisions")]
+    [ProducesResponseType(typeof(PagedResponse<DecisionSummaryDto>), 200)]
+    public async Task<IActionResult> GetDecisionHistory(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 20,
+        [FromQuery] string? decision = null,
+        [FromQuery] string? applicationId = null,
+        [FromQuery] DateTime? fromDate = null,
+        [FromQuery] DateTime? toDate = null,
+        CancellationToken ct = default)
+    {
+        var result = await _resultRepo.GetHistoryAsync(new DecisionHistoryQuery
+        {
+            TenantId = _tenantAccessor.TenantId,
+            Page = page,
+            PageSize = Math.Min(pageSize, 100),
+            Decision = decision,
+            ApplicationId = applicationId,
+            FromDate = fromDate,
+            ToDate = toDate
+        }, ct);
+
+        return Ok(result);
+    }
+
+    private static List<string> ExtractFieldPaths(ConditionGroup? group)
+    {
+        if (group == null) return new();
+        var fields = new List<string>();
+        foreach (var node in group.Rules)
+        {
+            if (node.IsGroup && node.Group != null)
+                fields.AddRange(ExtractFieldPaths(node.Group));
+            else if (node.Field != null)
+                fields.Add(node.Field);
+        }
+        return fields.Distinct().ToList();
+    }
+
+    private static bool IsValidFieldPath(string field) =>
+        !string.IsNullOrWhiteSpace(field) && field.Contains('.');
+}
+
+// ============================================================
+// REQUEST / RESPONSE DTOs
+// ============================================================
+
+public record BREExecutionRequest
+{
+    [Required]
+    public Dictionary<string, object> Data { get; init; } = new();
+    public string? CorrelationId { get; init; }
+    public string? ApplicationId { get; init; }
+    public string? ProductCode { get; init; }
+    public string? BranchCode { get; init; }
+    public string? StageCode { get; init; }
+    public Guid? RuleSetId { get; init; }
+    public string? SourceSystem { get; init; }
+    public bool? EnableAiAnalysis { get; init; }
+}
+
+public record BREDecisionResponse
+{
+    public Guid RequestId { get; init; }
+    public string CorrelationId { get; init; } = default!;
+    public string? ApplicationId { get; init; }
+    public string Decision { get; init; } = default!;
+    public string TrafficLight { get; init; } = default!;
+    public decimal RiskScore { get; init; }
+    public string RiskCategory { get; init; } = default!;
+    public int TotalRulesEvaluated { get; init; }
+    public int RulesPassed { get; init; }
+    public int RulesFailed { get; init; }
+    public int DeviationsCount { get; init; }
+    public int ExecutionMs { get; init; }
+    public List<RuleResultDto> RuleResults { get; init; } = new();
+    public string? AiSummary { get; init; }
+    public AiAnalysisDto? AiAnalysis { get; init; }
+    public Guid? ReportId { get; init; }
+    public DateTime GeneratedAt { get; init; }
+}
+
+public record RuleResultDto
+{
+    public string RuleCode { get; init; } = default!;
+    public string RuleName { get; init; } = default!;
+    public bool IsMatched { get; init; }
+    public List<string> ActionsExecuted { get; init; } = new();
+    public int ExecutionMs { get; init; }
+}
+
+public record AiAnalysisDto
+{
+    public string RiskSummary { get; init; } = default!;
+    public string CreditSummary { get; init; } = default!;
+    public List<string> Strengths { get; init; } = new();
+    public List<string> Weaknesses { get; init; } = new();
+    public string ApprovalRecommendation { get; init; } = default!;
+    public List<string> RejectionReasons { get; init; } = new();
+    public List<string> AdditionalDocuments { get; init; } = new();
+    public string UnderwritingNotes { get; init; } = default!;
+    public double ConfidenceScore { get; init; }
+}
+
+public record RuleValidationRequest
+{
+    public RuleDefinition? RuleDefinition { get; init; }
+    public Dictionary<string, object>? SampleData { get; init; }
+}
+
+public record RuleValidationResponse
+{
+    public bool IsValid { get; init; }
+    public List<string> Errors { get; init; } = new();
+    public List<string> Warnings { get; init; } = new();
+    public List<string> ExtractedFields { get; init; } = new();
+}
+
+public record SimulationRequest
+{
+    public Dictionary<string, object> Data { get; init; } = new();
+    public Guid? RuleSetId { get; init; }
+    public List<Guid>? RuleIds { get; init; }
+}
+
+public record PagedResponse<T>
+{
+    public List<T> Items { get; init; } = new();
+    public int TotalCount { get; init; }
+    public int Page { get; init; }
+    public int PageSize { get; init; }
+    public int TotalPages => (int)Math.Ceiling((double)TotalCount / PageSize);
+}
+
+public record DecisionSummaryDto
+{
+    public Guid RequestId { get; init; }
+    public string? ApplicationId { get; init; }
+    public string Decision { get; init; } = default!;
+    public string TrafficLight { get; init; } = default!;
+    public decimal RiskScore { get; init; }
+    public int DeviationsCount { get; init; }
+    public DateTime CreatedAt { get; init; }
+}
+
+public class DecisionHistoryQuery
+{
+    public Guid TenantId { get; set; }
+    public int Page { get; set; } = 1;
+    public int PageSize { get; set; } = 20;
+    public string? Decision { get; set; }
+    public string? ApplicationId { get; set; }
+    public DateTime? FromDate { get; set; }
+    public DateTime? ToDate { get; set; }
+}
+
+public interface IExecutionRequestRepository
+{
+    Task<ExecutionRequest> CreateAsync(ExecutionRequest request, CancellationToken ct = default);
+    Task MarkCompletedAsync(Guid id, CancellationToken ct = default);
+}
+
+public interface IExecutionResultRepository
+{
+    Task SaveAsync(ExecutionResult result, CancellationToken ct = default);
+    Task<ExecutionResult?> GetByRequestIdAsync(Guid requestId, Guid tenantId, CancellationToken ct = default);
+    Task<PagedResponse<DecisionSummaryDto>> GetHistoryAsync(DecisionHistoryQuery query, CancellationToken ct = default);
+}
+
+public interface ISandboxService
+{
+    Task<object> SimulateAsync(SandboxRequest request, CancellationToken ct = default);
+}
+
+public record SandboxRequest
+{
+    public Guid TenantId { get; init; }
+    public Guid? RuleSetId { get; init; }
+    public Dictionary<string, object> TestData { get; init; } = new();
+    public List<Guid>? RuleIds { get; init; }
+    public Guid CreatedBy { get; init; }
+}
+
+public interface IDecisionReportService
+{
+    Task<DecisionReport?> GenerateAsync(Guid requestId, ExecutionResult result, CancellationToken ct = default);
+}
+
+public class DecisionReport
+{
+    public Guid Id { get; set; }
+}
+
+public interface ITenantContextAccessor
+{
+    Guid TenantId { get; }
+    Guid UserId { get; }
+    string? UserEmail { get; }
+}

BREDbContext.cs

@@ -0,0 +1,337 @@
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.ChangeTracking;
+using OptimAI.BRE.Shared.Domain;
+using System.Text.Json;
+
+namespace OptimAI.BRE.RuleEngine.Infrastructure;
+
+public class BREDbContext : DbContext
+{
+    public BREDbContext(DbContextOptions<BREDbContext> options) : base(options) { }
+
+    public DbSet<Tenant> Tenants => Set<Tenant>();
+    public DbSet<TenantConfiguration> TenantConfigurations => Set<TenantConfiguration>();
+    public DbSet<User> Users => Set<User>();
+    public DbSet<Role> Roles => Set<Role>();
+    public DbSet<Permission> Permissions => Set<Permission>();
+    public DbSet<RolePermission> RolePermissions => Set<RolePermission>();
+    public DbSet<UserRole> UserRoles => Set<UserRole>();
+    public DbSet<ApiKey> ApiKeys => Set<ApiKey>();
+    public DbSet<RefreshToken> RefreshTokens => Set<RefreshToken>();
+    public DbSet<Product> Products => Set<Product>();
+    public DbSet<Branch> Branches => Set<Branch>();
+    public DbSet<LoanStage> LoanStages => Set<LoanStage>();
+    public DbSet<RuleCategory> RuleCategories => Set<RuleCategory>();
+    public DbSet<Rule> Rules => Set<Rule>();
+    public DbSet<RuleVersion> RuleVersions => Set<RuleVersion>();
+    public DbSet<RuleScope> RuleScopes => Set<RuleScope>();
+    public DbSet<RuleSet> RuleSets => Set<RuleSet>();
+    public DbSet<RuleSetMember> RuleSetMembers => Set<RuleSetMember>();
+    public DbSet<FieldCatalogEntry> FieldCatalog => Set<FieldCatalogEntry>();
+    public DbSet<ExecutionRequest> ExecutionRequests => Set<ExecutionRequest>();
+    public DbSet<ExecutionResult> ExecutionResults => Set<ExecutionResult>();
+    public DbSet<RuleExecutionDetail> RuleExecutionDetails => Set<RuleExecutionDetail>();
+    public DbSet<DeviationType> DeviationTypes => Set<DeviationType>();
+    public DbSet<ExecutionDeviation> ExecutionDeviations => Set<ExecutionDeviation>();
+    public DbSet<DecisionReportEntity> DecisionReports => Set<DecisionReportEntity>();
+    public DbSet<AuditLog> AuditLogs => Set<AuditLog>();
+    public DbSet<RuleApproval> RuleApprovals => Set<RuleApproval>();
+    public DbSet<AiGeneratedRuleEntity> AiGeneratedRules => Set<AiGeneratedRuleEntity>();
+
+    protected override void OnModelCreating(ModelBuilder model)
+    {
+        base.OnModelCreating(model);
+
+        // ---- TENANT ----
+        model.Entity<Tenant>(e =>
+        {
+            e.HasKey(t => t.Id);
+            e.HasIndex(t => t.TenantCode).IsUnique();
+            e.Property(t => t.Settings)
+                .HasConversion(
+                    v => JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => JsonSerializer.Deserialize<Dictionary<string, object>>(v, (JsonSerializerOptions?)null)!)
+                .HasColumnType("jsonb");
+        });
+
+        // ---- USER ----
+        model.Entity<User>(e =>
+        {
+            e.HasKey(u => u.Id);
+            e.HasIndex(u => new { u.TenantId, u.Email }).IsUnique();
+            e.HasIndex(u => new { u.TenantId, u.Username }).IsUnique();
+            e.HasOne(u => u.Tenant).WithMany(t => t.Users).HasForeignKey(u => u.TenantId);
+        });
+
+        // ---- ROLE ----
+        model.Entity<Role>(e =>
+        {
+            e.HasKey(r => r.Id);
+            e.HasIndex(r => new { r.TenantId, r.RoleCode }).IsUnique();
+        });
+
+        model.Entity<RolePermission>(e =>
+        {
+            e.HasKey(rp => new { rp.RoleId, rp.PermissionId });
+            e.HasOne(rp => rp.Role).WithMany(r => r.RolePermissions).HasForeignKey(rp => rp.RoleId);
+            e.HasOne(rp => rp.Permission).WithMany().HasForeignKey(rp => rp.PermissionId);
+        });
+
+        model.Entity<UserRole>(e =>
+        {
+            e.HasKey(ur => new { ur.UserId, ur.RoleId });
+            e.HasOne(ur => ur.User).WithMany(u => u.UserRoles).HasForeignKey(ur => ur.UserId);
+            e.HasOne(ur => ur.Role).WithMany(r => r.UserRoles).HasForeignKey(ur => ur.RoleId);
+        });
+
+        // ---- RULE ----
+        model.Entity<Rule>(e =>
+        {
+            e.HasKey(r => r.Id);
+            e.HasIndex(r => new { r.TenantId, r.RuleCode }).IsUnique();
+            e.HasIndex(r => new { r.TenantId, r.RuleType }).HasFilter("is_active = true AND is_published = true");
+            e.Property(r => r.Tags)
+                .HasConversion(
+                    v => JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => JsonSerializer.Deserialize<List<string>>(v, (JsonSerializerOptions?)null)!)
+                .HasColumnType("jsonb");
+            e.HasOne(r => r.Category).WithMany().HasForeignKey(r => r.CategoryId);
+            e.HasMany(r => r.Versions).WithOne(v => v.Rule).HasForeignKey(v => v.RuleId);
+            e.HasMany(r => r.Scopes).WithOne(s => s.Rule).HasForeignKey(s => s.RuleId);
+            e.HasOne(r => r.CurrentVersion).WithMany()
+                .HasForeignKey(r => r.CurrentVersionId)
+                .OnDelete(DeleteBehavior.SetNull);
+        });
+
+        // ---- RULE VERSION ----
+        model.Entity<RuleVersion>(e =>
+        {
+            e.HasKey(v => v.Id);
+            e.HasIndex(v => new { v.RuleId, v.VersionNumber }).IsUnique();
+            e.Property(v => v.RuleDefinition)
+                .HasConversion(
+                    v => JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => JsonSerializer.Deserialize<RuleDefinition>(v, (JsonSerializerOptions?)null)!)
+                .HasColumnType("jsonb");
+        });
+
+        // ---- RULE SCOPE ----
+        model.Entity<RuleScope>(e =>
+        {
+            e.HasKey(s => s.Id);
+        });
+
+        // ---- RULE SET ----
+        model.Entity<RuleSetMember>(e =>
+        {
+            e.HasKey(m => new { m.SetId, m.RuleId });
+            e.HasOne(m => m.RuleSet).WithMany(s => s.Members).HasForeignKey(m => m.SetId);
+            e.HasOne(m => m.Rule).WithMany().HasForeignKey(m => m.RuleId);
+        });
+
+        // ---- EXECUTION REQUEST ----
+        model.Entity<ExecutionRequest>(e =>
+        {
+            e.HasKey(r => r.Id);
+            e.HasIndex(r => r.CorrelationId).IsUnique();
+            e.HasIndex(r => new { r.TenantId, r.Status, r.CreatedAt });
+            e.Property(r => r.InputPayload)
+                .HasConversion(
+                    v => JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => JsonSerializer.Deserialize<Dictionary<string, object>>(v, (JsonSerializerOptions?)null)!)
+                .HasColumnType("jsonb");
+        });
+
+        // ---- EXECUTION RESULT ----
+        model.Entity<ExecutionResult>(e =>
+        {
+            e.HasKey(r => r.Id);
+            e.HasIndex(r => r.RequestId);
+            e.Property(r => r.RuleResults)
+                .HasConversion(
+                    v => JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => JsonSerializer.Deserialize<List<RuleExecutionSummary>>(v, (JsonSerializerOptions?)null)!)
+                .HasColumnType("jsonb");
+            e.Property(r => r.FieldValues)
+                .HasConversion(
+                    v => JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => JsonSerializer.Deserialize<Dictionary<string, object>>(v, (JsonSerializerOptions?)null)!)
+                .HasColumnType("jsonb");
+            e.Property(r => r.AiAnalysis)
+                .HasConversion(
+                    v => v == null ? null : JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => v == null ? null : JsonSerializer.Deserialize<AiAnalysis>(v, (JsonSerializerOptions?)null))
+                .HasColumnType("jsonb");
+        });
+
+        // ---- AUDIT LOG ----
+        model.Entity<AuditLog>(e =>
+        {
+            e.HasKey(a => a.Id);
+            e.HasIndex(a => new { a.TenantId, a.EntityType, a.EntityId, a.CreatedAt });
+            e.Property(a => a.OldValues)
+                .HasConversion(
+                    v => v == null ? null : JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => v == null ? null : JsonSerializer.Deserialize<Dictionary<string, object>>(v, (JsonSerializerOptions?)null))
+                .HasColumnType("jsonb");
+            e.Property(a => a.NewValues)
+                .HasConversion(
+                    v => v == null ? null : JsonSerializer.Serialize(v, (JsonSerializerOptions?)null),
+                    v => v == null ? null : JsonSerializer.Deserialize<Dictionary<string, object>>(v, (JsonSerializerOptions?)null))
+                .HasColumnType("jsonb");
+        });
+
+        // ---- DEVIATION ----
+        model.Entity<ExecutionDeviation>(e =>
+        {
+            e.HasKey(d => d.Id);
+            e.HasIndex(d => d.ResultId);
+        });
+
+        // Global query filters for soft-delete / tenant isolation
+        model.Entity<Rule>().HasQueryFilter(r => r.IsActive);
+        model.Entity<User>().HasQueryFilter(u => u.IsActive);
+    }
+
+    public override Task<int> SaveChangesAsync(CancellationToken ct = default)
+    {
+        UpdateTimestamps();
+        return base.SaveChangesAsync(ct);
+    }
+
+    private void UpdateTimestamps()
+    {
+        foreach (var entry in ChangeTracker.Entries<BaseEntity>())
+        {
+            if (entry.State == EntityState.Modified)
+                entry.Entity.UpdatedAt = DateTime.UtcNow;
+        }
+    }
+}
+
+// DB entity aliases needed for EF mapping
+public class TenantConfiguration : TenantEntity
+{
+    public string ConfigKey { get; set; } = default!;
+    public string? ConfigValue { get; set; }
+    public string ConfigType { get; set; } = "STRING";
+    public string? Category { get; set; }
+    public bool IsEncrypted { get; set; }
+}
+
+public class RefreshToken
+{
+    public Guid Id { get; set; }
+    public Guid UserId { get; set; }
+    public string TokenHash { get; set; } = default!;
+    public DateTime ExpiresAt { get; set; }
+    public bool IsRevoked { get; set; }
+    public string? IpAddress { get; set; }
+    public string? UserAgent { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+}
+
+public class Product : TenantEntity
+{
+    public string ProductCode { get; set; } = default!;
+    public string ProductName { get; set; } = default!;
+    public string ProductType { get; set; } = default!;
+    public string? Description { get; set; }
+    public bool IsActive { get; set; } = true;
+    public Dictionary<string, object> Config { get; set; } = new();
+}
+
+public class Branch : TenantEntity
+{
+    public string BranchCode { get; set; } = default!;
+    public string BranchName { get; set; } = default!;
+    public string? Region { get; set; }
+    public string? State { get; set; }
+    public string? City { get; set; }
+    public string? Zone { get; set; }
+    public bool IsActive { get; set; } = true;
+}
+
+public class LoanStage : TenantEntity
+{
+    public string StageCode { get; set; } = default!;
+    public string StageName { get; set; } = default!;
+    public int StageOrder { get; set; }
+    public string? Description { get; set; }
+    public bool IsActive { get; set; } = true;
+}
+
+public class FieldCatalogEntry
+{
+    public Guid Id { get; set; }
+    public Guid? TenantId { get; set; }
+    public string FieldPath { get; set; } = default!;
+    public string DisplayName { get; set; } = default!;
+    public string? Description { get; set; }
+    public string DataType { get; set; } = default!;
+    public string? Category { get; set; }
+    public bool IsSystemField { get; set; }
+    public bool IsActive { get; set; } = true;
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+}
+
+public class RuleApproval
+{
+    public Guid Id { get; set; }
+    public Guid RuleId { get; set; }
+    public Guid VersionId { get; set; }
+    public Guid TenantId { get; set; }
+    public Guid RequestedBy { get; set; }
+    public DateTime RequestedAt { get; set; } = DateTime.UtcNow;
+    public Guid? ReviewedBy { get; set; }
+    public DateTime? ReviewedAt { get; set; }
+    public string Status { get; set; } = "PENDING";
+    public string? Comments { get; set; }
+}
+
+public class RuleExecutionDetail
+{
+    public Guid Id { get; set; }
+    public Guid ResultId { get; set; }
+    public Guid RuleId { get; set; }
+    public string RuleCode { get; set; } = default!;
+    public string RuleName { get; set; } = default!;
+    public int VersionNumber { get; set; }
+    public int ExecutionOrder { get; set; }
+    public bool IsMatched { get; set; }
+    public string ConditionsEvaluated { get; set; } = "[]";
+    public string ActionsExecuted { get; set; } = "[]";
+    public int? ExecutionMs { get; set; }
+    public string? ErrorMessage { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+}
+
+public class DecisionReportEntity
+{
+    public Guid Id { get; set; }
+    public Guid RequestId { get; set; }
+    public Guid TenantId { get; set; }
+    public string? ReportNumber { get; set; }
+    public string? ApplicationId { get; set; }
+    public string? ProductCode { get; set; }
+    public string FinalDecision { get; set; } = default!;
+    public decimal? RiskScore { get; set; }
+    public string? RiskCategory { get; set; }
+    public string? TrafficLight { get; set; }
+    public string? Summary { get; set; }
+    public string? ReportJson { get; set; }
+    public string? PdfStoragePath { get; set; }
+    public DateTime GeneratedAt { get; set; } = DateTime.UtcNow;
+}
+
+public class AiGeneratedRuleEntity
+{
+    public Guid Id { get; set; }
+    public Guid TenantId { get; set; }
+    public string UserPrompt { get; set; } = default!;
+    public string GeneratedRule { get; set; } = "{}";
+    public Guid? RuleId { get; set; }
+    public bool? IsAccepted { get; set; }
+    public Guid CreatedBy { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+}

CachedRuleLoader.cs

@@ -0,0 +1,131 @@
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Caching.Distributed;
+using Microsoft.Extensions.Logging;
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.Shared.Domain;
+using System.Text.Json;
+
+namespace OptimAI.BRE.RuleEngine.Infrastructure;
+
+/// <summary>
+/// Redis-backed rule loader with 5-minute cache TTL.
+/// Cache key includes tenant + product + branch + stage for scope-aware loading.
+/// </summary>
+public sealed class CachedRuleLoader : IRuleLoader
+{
+    private readonly BREDbContext _db;
+    private readonly IDistributedCache _cache;
+    private readonly ILogger<CachedRuleLoader> _logger;
+
+    private static readonly JsonSerializerOptions _jsonOpts = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
+    };
+
+    public CachedRuleLoader(BREDbContext db, IDistributedCache cache, ILogger<CachedRuleLoader> logger)
+    {
+        _db = db;
+        _cache = cache;
+        _logger = logger;
+    }
+
+    public async Task<IReadOnlyList<Rule>> LoadRulesAsync(RuleLoadRequest request, CancellationToken ct = default)
+    {
+        var cacheKey = BuildCacheKey(request);
+
+        var cached = await _cache.GetStringAsync(cacheKey, ct);
+        if (cached != null)
+        {
+            _logger.LogDebug("Cache HIT for rules: {Key}", cacheKey);
+            return JsonSerializer.Deserialize<List<Rule>>(cached, _jsonOpts) ?? new();
+        }
+
+        _logger.LogDebug("Cache MISS for rules: {Key}", cacheKey);
+        var rules = await LoadFromDatabaseAsync(request, ct);
+
+        await _cache.SetStringAsync(cacheKey,
+            JsonSerializer.Serialize(rules, _jsonOpts),
+            new DistributedCacheEntryOptions
+            {
+                AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5)
+            }, ct);
+
+        return rules;
+    }
+
+    public async Task<Rule?> LoadRuleByCodeAsync(Guid tenantId, string ruleCode, CancellationToken ct = default)
+    {
+        return await _db.Rules
+            .Include(r => r.CurrentVersion)
+            .Include(r => r.Scopes)
+            .FirstOrDefaultAsync(r => r.TenantId == tenantId && r.RuleCode == ruleCode, ct);
+    }
+
+    private async Task<List<Rule>> LoadFromDatabaseAsync(RuleLoadRequest request, CancellationToken ct)
+    {
+        var query = _db.Rules
+            .Include(r => r.CurrentVersion)
+            .Include(r => r.Scopes)
+            .Where(r => r.TenantId == request.TenantId);
+
+        if (request.PublishedOnly)
+            query = query.Where(r => r.IsPublished && r.Status == RuleStatus.Published);
+
+        if (request.RuleTypes.Any())
+            query = query.Where(r => request.RuleTypes.Contains(r.RuleType));
+
+        if (request.RuleSetId.HasValue)
+        {
+            var ruleIds = await _db.RuleSetMembers
+                .Where(m => m.SetId == request.RuleSetId.Value)
+                .Select(m => m.RuleId)
+                .ToListAsync(ct);
+
+            query = query.Where(r => ruleIds.Contains(r.Id));
+        }
+        else
+        {
+            // Scope filtering: include GLOBAL rules + rules scoped to the request context
+            query = query.Where(r =>
+                !r.Scopes.Any() ||  // no scope = global
+                r.Scopes.Any(s => s.ScopeType == ScopeType.Global) ||
+                (request.ProductCode != null && r.Scopes.Any(s =>
+                    s.ScopeType == ScopeType.Product && s.ScopeValue == request.ProductCode && !s.IsExcluded)) ||
+                (request.BranchCode != null && r.Scopes.Any(s =>
+                    s.ScopeType == ScopeType.Branch && s.ScopeValue == request.BranchCode && !s.IsExcluded)) ||
+                (request.StageCode != null && r.Scopes.Any(s =>
+                    s.ScopeType == ScopeType.Stage && s.ScopeValue == request.StageCode && !s.IsExcluded))
+            );
+        }
+
+        return await query
+            .OrderBy(r => r.Priority)
+            .AsNoTracking()
+            .ToListAsync(ct);
+    }
+
+    public async Task InvalidateCacheAsync(Guid tenantId, CancellationToken ct = default)
+    {
+        // Invalidate all rule cache entries for this tenant
+        // In production, use a tag-based cache invalidation strategy
+        var pattern = $"bre:rules:{tenantId}:*";
+        _logger.LogInformation("Invalidating rule cache for tenant {TenantId}", tenantId);
+        // Redis SCAN + DEL for pattern — implement via IConnectionMultiplexer if needed
+    }
+
+    private static string BuildCacheKey(RuleLoadRequest request)
+    {
+        var parts = new[]
+        {
+            "bre", "rules",
+            request.TenantId.ToString(),
+            request.ProductCode ?? "ALL",
+            request.BranchCode ?? "ALL",
+            request.StageCode ?? "ALL",
+            request.RuleSetId?.ToString() ?? "ALL",
+            string.Join(",", request.RuleTypes.OrderBy(t => t.ToString())),
+            request.PublishedOnly ? "pub" : "all"
+        };
+        return string.Join(":", parts);
+    }
+}

ConditionEvaluator.cs

@@ -0,0 +1,167 @@
+using System.Text.RegularExpressions;
+using Microsoft.Extensions.Logging;
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.Shared.Domain;
+
+namespace OptimAI.BRE.RuleEngine.Application;
+
+public sealed class ConditionEvaluator : IConditionEvaluator
+{
+    private readonly IDynamicFieldResolver _fieldResolver;
+    private readonly ILogger<ConditionEvaluator> _logger;
+
+    public ConditionEvaluator(IDynamicFieldResolver fieldResolver, ILogger<ConditionEvaluator> logger)
+    {
+        _fieldResolver = fieldResolver;
+        _logger = logger;
+    }
+
+    public bool Evaluate(ConditionNode condition, DynamicDataContext context)
+    {
+        try
+        {
+            var actualValue = ResolveValue(condition.Field!, context);
+            var expectedValue = ResolveExpectedValue(condition, context);
+
+            return condition.Operator switch
+            {
+                ComparisonOperator.Equals => AreEqual(actualValue, expectedValue),
+                ComparisonOperator.NotEquals => !AreEqual(actualValue, expectedValue),
+                ComparisonOperator.GreaterThan => Compare(actualValue, expectedValue) > 0,
+                ComparisonOperator.GreaterThanOrEqual => Compare(actualValue, expectedValue) >= 0,
+                ComparisonOperator.LessThan => Compare(actualValue, expectedValue) < 0,
+                ComparisonOperator.LessThanOrEqual => Compare(actualValue, expectedValue) <= 0,
+                ComparisonOperator.Between => EvaluateBetween(actualValue, condition, context),
+                ComparisonOperator.NotBetween => !EvaluateBetween(actualValue, condition, context),
+                ComparisonOperator.In => EvaluateIn(actualValue, condition.Value),
+                ComparisonOperator.NotIn => !EvaluateIn(actualValue, condition.Value),
+                ComparisonOperator.Contains => EvaluateContains(actualValue, expectedValue),
+                ComparisonOperator.NotContains => !EvaluateContains(actualValue, expectedValue),
+                ComparisonOperator.StartsWith => EvaluateStartsWith(actualValue, expectedValue),
+                ComparisonOperator.EndsWith => EvaluateEndsWith(actualValue, expectedValue),
+                ComparisonOperator.IsNull => actualValue == null,
+                ComparisonOperator.IsNotNull => actualValue != null,
+                ComparisonOperator.IsTrue => IsTruthy(actualValue),
+                ComparisonOperator.IsFalse => !IsTruthy(actualValue),
+                ComparisonOperator.Regex => EvaluateRegex(actualValue, expectedValue?.ToString()),
+                _ => false
+            };
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Condition evaluation failed for field {Field}", condition.Field);
+            return false;
+        }
+    }
+
+    private object? ResolveValue(string field, DynamicDataContext context)
+    {
+        return _fieldResolver.TryResolve(field, context, out var value) ? value : null;
+    }
+
+    private object? ResolveExpectedValue(ConditionNode condition, DynamicDataContext context)
+    {
+        return condition.ValueType switch
+        {
+            ValueType.Field when condition.ReferenceField != null => ResolveValue(condition.ReferenceField, context),
+            ValueType.Literal => condition.Value,
+            _ => condition.Value
+        };
+    }
+
+    private static bool AreEqual(object? left, object? right)
+    {
+        if (left == null && right == null) return true;
+        if (left == null || right == null) return false;
+
+        if (TryToDecimal(left, out var ld) && TryToDecimal(right, out var rd))
+            return ld == rd;
+
+        return left.ToString()?.Equals(right.ToString(), StringComparison.OrdinalIgnoreCase) ?? false;
+    }
+
+    private static int Compare(object? left, object? right)
+    {
+        if (left == null && right == null) return 0;
+        if (left == null) return -1;
+        if (right == null) return 1;
+
+        if (TryToDecimal(left, out var ld) && TryToDecimal(right, out var rd))
+            return ld.CompareTo(rd);
+
+        if (left is DateTime dl && right is DateTime dr)
+            return dl.CompareTo(dr);
+
+        return string.Compare(left.ToString(), right.ToString(), StringComparison.OrdinalIgnoreCase);
+    }
+
+    private bool EvaluateBetween(object? actual, ConditionNode condition, DynamicDataContext context)
+    {
+        var value1 = ResolveExpectedValue(condition, context);
+        var value2 = condition.Value2 != null ? (object)condition.Value2 : null;
+
+        if (value1 == null || value2 == null) return false;
+        return Compare(actual, value1) >= 0 && Compare(actual, value2) <= 0;
+    }
+
+    private static bool EvaluateIn(object? actual, object? values)
+    {
+        if (actual == null || values == null) return false;
+
+        IEnumerable<object> list = values switch
+        {
+            IEnumerable<object> e => e,
+            string s => s.Split(',').Select(x => (object)x.Trim()),
+            _ => new[] { values }
+        };
+
+        return list.Any(v => AreEqual(actual, v));
+    }
+
+    private static bool EvaluateContains(object? actual, object? expected)
+    {
+        if (actual == null || expected == null) return false;
+
+        if (actual is IEnumerable<object> list)
+            return list.Any(item => AreEqual(item, expected));
+
+        return actual.ToString()?.Contains(expected.ToString() ?? "", StringComparison.OrdinalIgnoreCase) ?? false;
+    }
+
+    private static bool EvaluateStartsWith(object? actual, object? expected)
+        => actual?.ToString()?.StartsWith(expected?.ToString() ?? "", StringComparison.OrdinalIgnoreCase) ?? false;
+
+    private static bool EvaluateEndsWith(object? actual, object? expected)
+        => actual?.ToString()?.EndsWith(expected?.ToString() ?? "", StringComparison.OrdinalIgnoreCase) ?? false;
+
+    private static bool EvaluateRegex(object? actual, string? pattern)
+    {
+        if (actual == null || pattern == null) return false;
+        return Regex.IsMatch(actual.ToString()!, pattern, RegexOptions.IgnoreCase);
+    }
+
+    private static bool IsTruthy(object? value) => value switch
+    {
+        bool b => b,
+        decimal d => d != 0,
+        int i => i != 0,
+        string s => !string.IsNullOrEmpty(s) && s != "0" && s.ToLower() != "false",
+        null => false,
+        _ => true
+    };
+
+    private static bool TryToDecimal(object value, out decimal result)
+    {
+        result = 0;
+        return value switch
+        {
+            decimal d => (result = d) == d,
+            double d => (result = (decimal)d) == result,
+            float f => (result = (decimal)f) == result,
+            int i => (result = i) == i,
+            long l => (result = l) == l,
+            string s => decimal.TryParse(s, out result),
+            _ => false
+        };
+    }
+}

ConditionGroupEditor.tsx

@@ -0,0 +1,166 @@
+'use client'
+
+import React from 'react'
+import { v4 as uuidv4 } from 'uuid'
+import type { ConditionGroup, ConditionNode, FieldCatalogEntry, LogicalOperator, ComparisonOperator } from '@/types'
+import { ConditionNodeEditor } from './ConditionNodeEditor'
+
+interface Props {
+  group: ConditionGroup
+  fieldCatalog: FieldCatalogEntry[]
+  onChange: (group: ConditionGroup) => void
+  readOnly?: boolean
+  depth: number
+}
+
+const GROUP_COLORS = [
+  'border-blue-300 bg-blue-50',
+  'border-purple-300 bg-purple-50',
+  'border-teal-300 bg-teal-50',
+  'border-orange-300 bg-orange-50',
+]
+
+export function ConditionGroupEditor({ group, fieldCatalog, onChange, readOnly, depth }: Props) {
+  const colorClass = GROUP_COLORS[depth % GROUP_COLORS.length]
+
+  const updateOperator = (operator: LogicalOperator) =>
+    onChange({ ...group, operator })
+
+  const addCondition = () => {
+    const newNode: ConditionNode = {
+      id: uuidv4(),
+      isGroup: false,
+      field: '',
+      operator: 'EQUALS',
+      value: '',
+      valueType: 'LITERAL',
+    }
+    onChange({ ...group, rules: [...group.rules, newNode] })
+  }
+
+  const addGroup = () => {
+    const nestedGroup: ConditionGroup = {
+      id: uuidv4(),
+      operator: 'AND',
+      rules: [],
+    }
+    const newNode: ConditionNode = {
+      id: uuidv4(),
+      isGroup: true,
+      group: nestedGroup,
+    }
+    onChange({ ...group, rules: [...group.rules, newNode] })
+  }
+
+  const updateNode = (index: number, updated: ConditionNode) => {
+    const next = [...group.rules]
+    next[index] = updated
+    onChange({ ...group, rules: next })
+  }
+
+  const deleteNode = (index: number) => {
+    onChange({ ...group, rules: group.rules.filter((_, i) => i !== index) })
+  }
+
+  return (
+    <div className={`rounded-lg border-2 ${colorClass} p-4`}>
+      {/* Group Header */}
+      <div className="flex items-center gap-3 mb-4">
+        <span className="text-xs font-semibold text-gray-500 uppercase tracking-wider">
+          Match
+        </span>
+        <div className="flex rounded-lg overflow-hidden border border-gray-200">
+          {(['AND', 'OR', 'NOT'] as LogicalOperator[]).map((op) => (
+            <button
+              key={op}
+              disabled={readOnly}
+              onClick={() => updateOperator(op)}
+              className={`px-3 py-1 text-xs font-bold transition-colors ${
+                group.operator === op
+                  ? op === 'AND'
+                    ? 'bg-blue-600 text-white'
+                    : op === 'OR'
+                    ? 'bg-purple-600 text-white'
+                    : 'bg-red-600 text-white'
+                  : 'bg-white text-gray-600 hover:bg-gray-50'
+              }`}
+            >
+              {op}
+            </button>
+          ))}
+        </div>
+        <span className="text-xs text-gray-400">
+          {group.operator === 'AND' ? 'all of the following' : group.operator === 'OR' ? 'any of the following' : 'NOT the following'}
+        </span>
+      </div>
+
+      {/* Conditions */}
+      <div className="space-y-2">
+        {group.rules.length === 0 && (
+          <div className="text-center py-4 text-gray-400 text-sm">
+            {readOnly ? 'No conditions' : 'Add conditions below'}
+          </div>
+        )}
+        {group.rules.map((node, idx) => (
+          <div key={node.id} className="flex items-start gap-2">
+            {idx > 0 && (
+              <div className="mt-3 px-2 py-0.5 rounded text-xs font-bold text-gray-400 min-w-[36px] text-center">
+                {group.operator}
+              </div>
+            )}
+            <div className={`flex-1 ${idx === 0 ? '' : ''}`}>
+              {node.isGroup && node.group ? (
+                <ConditionGroupEditor
+                  group={node.group}
+                  fieldCatalog={fieldCatalog}
+                  depth={depth + 1}
+                  readOnly={readOnly}
+                  onChange={(updated) =>
+                    updateNode(idx, { ...node, group: updated })
+                  }
+                />
+              ) : (
+                <ConditionNodeEditor
+                  node={node}
+                  fieldCatalog={fieldCatalog}
+                  readOnly={readOnly}
+                  onChange={(updated) => updateNode(idx, updated)}
+                  onDelete={() => deleteNode(idx)}
+                />
+              )}
+            </div>
+            {!readOnly && (
+              <button
+                onClick={() => deleteNode(idx)}
+                className="mt-2 text-gray-300 hover:text-red-500 transition-colors"
+                title="Delete condition"
+              >
+                ✕
+              </button>
+            )}
+          </div>
+        ))}
+      </div>
+
+      {/* Add Buttons */}
+      {!readOnly && (
+        <div className="flex items-center gap-2 mt-4">
+          <button
+            onClick={addCondition}
+            className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium text-blue-700 bg-blue-100 hover:bg-blue-200 rounded-lg transition-colors"
+          >
+            <span className="text-base leading-none">+</span> Add Condition
+          </button>
+          {depth < 3 && (
+            <button
+              onClick={addGroup}
+              className="flex items-center gap-1.5 px-3 py-1.5 text-xs font-medium text-purple-700 bg-purple-100 hover:bg-purple-200 rounded-lg transition-colors"
+            >
+              <span className="text-base leading-none">⊞</span> Add Group
+            </button>
+          )}
+        </div>
+      )}
+    </div>
+  )
+}

ConditionNodeEditor.tsx

@@ -0,0 +1,197 @@
+'use client'
+
+import React, { useState } from 'react'
+import type { ConditionNode, FieldCatalogEntry, ComparisonOperator } from '@/types'
+
+interface Props {
+  node: ConditionNode
+  fieldCatalog: FieldCatalogEntry[]
+  onChange: (node: ConditionNode) => void
+  onDelete: () => void
+  readOnly?: boolean
+}
+
+const OPERATORS: { value: ComparisonOperator; label: string; showValue: 'single' | 'double' | 'none' | 'multi' }[] = [
+  { value: 'EQUALS', label: '= Equals', showValue: 'single' },
+  { value: 'NOT_EQUALS', label: '≠ Not Equals', showValue: 'single' },
+  { value: 'GREATER_THAN', label: '> Greater Than', showValue: 'single' },
+  { value: 'GREATER_THAN_OR_EQUAL', label: '≥ Greater Than or Equal', showValue: 'single' },
+  { value: 'LESS_THAN', label: '< Less Than', showValue: 'single' },
+  { value: 'LESS_THAN_OR_EQUAL', label: '≤ Less Than or Equal', showValue: 'single' },
+  { value: 'BETWEEN', label: '↔ Between', showValue: 'double' },
+  { value: 'IN', label: '∈ In (comma separated)', showValue: 'single' },
+  { value: 'NOT_IN', label: '∉ Not In', showValue: 'single' },
+  { value: 'CONTAINS', label: '⊆ Contains', showValue: 'single' },
+  { value: 'IS_NULL', label: '∅ Is Empty/Null', showValue: 'none' },
+  { value: 'IS_NOT_NULL', label: '• Is Not Null', showValue: 'none' },
+  { value: 'IS_TRUE', label: '✓ Is True', showValue: 'none' },
+  { value: 'IS_FALSE', label: '✗ Is False', showValue: 'none' },
+  { value: 'REGEX', label: '⚙ Matches Regex', showValue: 'single' },
+]
+
+const FIELD_CATEGORIES = ['BUREAU', 'INCOME', 'PERSONAL', 'EMPLOYMENT', 'VEHICLE', 'FI', 'LOAN', 'RATIOS', 'FRAUD', 'GST', 'ITR', 'KYC']
+
+export function ConditionNodeEditor({ node, fieldCatalog, onChange, onDelete, readOnly }: Props) {
+  const [showFieldSearch, setShowFieldSearch] = useState(false)
+  const [fieldSearch, setFieldSearch] = useState('')
+
+  const selectedOp = OPERATORS.find((o) => o.value === node.operator)
+  const selectedField = fieldCatalog.find((f) => f.fieldPath === node.field)
+
+  const filteredFields = fieldCatalog.filter(
+    (f) =>
+      !fieldSearch ||
+      f.fieldPath.toLowerCase().includes(fieldSearch.toLowerCase()) ||
+      f.displayName.toLowerCase().includes(fieldSearch.toLowerCase())
+  )
+
+  const groupedFields = FIELD_CATEGORIES.reduce<Record<string, FieldCatalogEntry[]>>((acc, cat) => {
+    const fields = filteredFields.filter((f) => f.category === cat)
+    if (fields.length > 0) acc[cat] = fields
+    return acc
+  }, {})
+
+  return (
+    <div className="flex items-center gap-2 bg-white border border-gray-200 rounded-lg px-3 py-2 group hover:border-blue-300 transition-colors">
+      {/* Field Selector */}
+      <div className="relative min-w-[220px]">
+        <button
+          disabled={readOnly}
+          onClick={() => !readOnly && setShowFieldSearch(!showFieldSearch)}
+          className="w-full text-left text-sm px-2 py-1 rounded border border-gray-200 hover:border-blue-400 focus:outline-none focus:border-blue-500 bg-gray-50"
+        >
+          {selectedField ? (
+            <span className="text-gray-800">{selectedField.displayName}</span>
+          ) : (
+            <span className="text-gray-400">Select field...</span>
+          )}
+        </button>
+
+        {showFieldSearch && !readOnly && (
+          <div className="absolute top-full left-0 mt-1 w-80 bg-white border border-gray-200 rounded-xl shadow-xl z-50 max-h-72 overflow-auto">
+            <div className="p-2 border-b sticky top-0 bg-white">
+              <input
+                autoFocus
+                value={fieldSearch}
+                onChange={(e) => setFieldSearch(e.target.value)}
+                placeholder="Search fields..."
+                className="w-full text-sm px-2 py-1.5 border border-gray-200 rounded-lg focus:outline-none focus:border-blue-400"
+              />
+            </div>
+            {Object.entries(groupedFields).map(([cat, fields]) => (
+              <div key={cat}>
+                <div className="px-3 py-1 text-xs font-semibold text-gray-400 uppercase tracking-wider bg-gray-50">
+                  {cat}
+                </div>
+                {fields.map((f) => (
+                  <button
+                    key={f.fieldPath}
+                    onClick={() => {
+                      onChange({ ...node, field: f.fieldPath })
+                      setShowFieldSearch(false)
+                      setFieldSearch('')
+                    }}
+                    className="w-full text-left px-3 py-2 text-sm hover:bg-blue-50 hover:text-blue-700 flex items-center justify-between"
+                  >
+                    <span>{f.displayName}</span>
+                    <span className="text-xs text-gray-400 font-mono">{f.dataType}</span>
+                  </button>
+                ))}
+              </div>
+            ))}
+          </div>
+        )}
+      </div>
+
+      {/* Operator Selector */}
+      <select
+        disabled={readOnly}
+        value={node.operator ?? 'EQUALS'}
+        onChange={(e) => onChange({ ...node, operator: e.target.value as ComparisonOperator })}
+        className="text-sm border border-gray-200 rounded-lg px-2 py-1 bg-gray-50 focus:outline-none focus:border-blue-500 min-w-[160px]"
+      >
+        {OPERATORS.map((op) => (
+          <option key={op.value} value={op.value}>{op.label}</option>
+        ))}
+      </select>
+
+      {/* Value Input(s) */}
+      {selectedOp?.showValue === 'single' && (
+        <ValueInput
+          value={String(node.value ?? '')}
+          fieldType={selectedField?.dataType}
+          readOnly={readOnly}
+          onChange={(v) => onChange({ ...node, value: v })}
+          placeholder="Value"
+        />
+      )}
+
+      {selectedOp?.showValue === 'double' && (
+        <>
+          <ValueInput
+            value={String(node.value ?? '')}
+            fieldType={selectedField?.dataType}
+            readOnly={readOnly}
+            onChange={(v) => onChange({ ...node, value: v })}
+            placeholder="From"
+          />
+          <span className="text-gray-400 text-sm">and</span>
+          <ValueInput
+            value={String(node.value2 ?? '')}
+            fieldType={selectedField?.dataType}
+            readOnly={readOnly}
+            onChange={(v) => onChange({ ...node, value2: v })}
+            placeholder="To"
+          />
+        </>
+      )}
+
+      {/* Field badge */}
+      {node.field && (
+        <span className="text-xs font-mono text-gray-400 truncate max-w-[120px]" title={node.field}>
+          {node.field}
+        </span>
+      )}
+    </div>
+  )
+}
+
+function ValueInput({
+  value,
+  fieldType,
+  onChange,
+  placeholder,
+  readOnly,
+}: {
+  value: string
+  fieldType?: string
+  onChange: (v: string) => void
+  placeholder: string
+  readOnly?: boolean
+}) {
+  if (fieldType === 'BOOLEAN') {
+    return (
+      <select
+        disabled={readOnly}
+        value={value}
+        onChange={(e) => onChange(e.target.value)}
+        className="text-sm border border-gray-200 rounded-lg px-2 py-1 bg-gray-50 focus:outline-none focus:border-blue-500"
+      >
+        <option value="">Select...</option>
+        <option value="true">True</option>
+        <option value="false">False</option>
+      </select>
+    )
+  }
+
+  return (
+    <input
+      type={fieldType === 'NUMBER' ? 'number' : fieldType === 'DATE' ? 'date' : 'text'}
+      disabled={readOnly}
+      value={value}
+      onChange={(e) => onChange(e.target.value)}
+      placeholder={placeholder}
+      className="text-sm border border-gray-200 rounded-lg px-2 py-1.5 bg-gray-50 focus:outline-none focus:border-blue-500 w-32"
+    />
+  )
+}

DashboardPage.tsx

@@ -0,0 +1,269 @@
+'use client'
+
+import React from 'react'
+import { useQuery } from '@tanstack/react-query'
+import {
+  LineChart, Line, BarChart, Bar, PieChart, Pie, Cell,
+  XAxis, YAxis, CartesianGrid, Tooltip, ResponsiveContainer, Legend
+} from 'recharts'
+import type { DashboardStats, ExecutionTrend, RuleHitAnalysis, DeviationAnalysisSummary } from '@/types'
+import { apiClient } from '@/lib/api-client'
+
+const TRAFFIC_COLORS = {
+  approved: '#10b981',
+  rejected: '#ef4444',
+  deviations: '#f59e0b',
+}
+
+export function DashboardPage() {
+  const { data: stats } = useQuery<DashboardStats>({
+    queryKey: ['dashboard-stats'],
+    queryFn: () => apiClient.get('/analytics/dashboard-stats'),
+    refetchInterval: 30_000,
+  })
+
+  const { data: trends } = useQuery<ExecutionTrend[]>({
+    queryKey: ['execution-trends'],
+    queryFn: () => apiClient.get('/analytics/execution-trends?days=30'),
+  })
+
+  const { data: topRules } = useQuery<RuleHitAnalysis[]>({
+    queryKey: ['rule-hit-analysis'],
+    queryFn: () => apiClient.get('/analytics/rule-hit-analysis?limit=10'),
+  })
+
+  const { data: deviations } = useQuery<DeviationAnalysisSummary[]>({
+    queryKey: ['deviation-analysis'],
+    queryFn: () => apiClient.get('/analytics/deviation-analysis'),
+  })
+
+  const decisionData = stats
+    ? [
+        { name: 'Approved', value: stats.approvalRate, color: '#10b981' },
+        { name: 'Rejected', value: stats.rejectionRate, color: '#ef4444' },
+        { name: 'Deviation', value: stats.deviationRate, color: '#f59e0b' },
+      ]
+    : []
+
+  return (
+    <div className="p-6 space-y-6">
+      {/* Header */}
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold text-gray-900">OPTIM AI BRE Dashboard</h1>
+          <p className="text-gray-500 text-sm mt-1">Real-time rule engine analytics and insights</p>
+        </div>
+        <div className="flex items-center gap-2">
+          <div className="w-2 h-2 rounded-full bg-emerald-500 animate-pulse" />
+          <span className="text-sm text-gray-500">Live</span>
+        </div>
+      </div>
+
+      {/* KPI Cards */}
+      <div className="grid grid-cols-2 md:grid-cols-4 gap-4">
+        <KPICard
+          label="Total Executions Today"
+          value={stats?.todayExecutions?.toLocaleString() ?? '—'}
+          sub={`${stats?.totalExecutions?.toLocaleString() ?? '—'} total`}
+          color="blue"
+          icon="⚡"
+        />
+        <KPICard
+          label="Approval Rate"
+          value={`${stats?.approvalRate?.toFixed(1) ?? '—'}%`}
+          sub="GREEN decisions"
+          color="emerald"
+          icon="✅"
+        />
+        <KPICard
+          label="Rejection Rate"
+          value={`${stats?.rejectionRate?.toFixed(1) ?? '—'}%`}
+          sub="RED decisions"
+          color="red"
+          icon="🚫"
+        />
+        <KPICard
+          label="Avg Risk Score"
+          value={stats?.avgRiskScore?.toFixed(1) ?? '—'}
+          sub="/100"
+          color="amber"
+          icon="📊"
+        />
+      </div>
+
+      <div className="grid grid-cols-2 md:grid-cols-4 gap-4">
+        <KPICard
+          label="Published Rules"
+          value={stats?.publishedRules?.toLocaleString() ?? '—'}
+          sub={`${stats?.activeRules ?? '—'} active`}
+          color="purple"
+          icon="📜"
+        />
+        <KPICard
+          label="Deviation Rate"
+          value={`${stats?.deviationRate?.toFixed(1) ?? '—'}%`}
+          sub="AMBER decisions"
+          color="orange"
+          icon="⚠️"
+        />
+        <KPICard
+          label="Avg Execution Time"
+          value={`${stats?.avgExecutionMs?.toFixed(0) ?? '—'}ms`}
+          sub="per decision"
+          color="teal"
+          icon="⏱️"
+        />
+        <KPICard
+          label="Total Rules"
+          value={stats?.totalRules?.toLocaleString() ?? '—'}
+          sub={`${stats?.draftRules ?? '—'} in draft`}
+          color="indigo"
+          icon="⚙️"
+        />
+      </div>
+
+      {/* Charts Row 1 */}
+      <div className="grid grid-cols-3 gap-6">
+        {/* Execution Trend */}
+        <div className="col-span-2 bg-white rounded-xl border border-gray-200 p-5">
+          <h2 className="text-base font-semibold text-gray-800 mb-4">Decision Trend (30 Days)</h2>
+          <ResponsiveContainer width="100%" height={220}>
+            <LineChart data={trends ?? []}>
+              <CartesianGrid strokeDasharray="3 3" stroke="#f0f0f0" />
+              <XAxis dataKey="date" tick={{ fontSize: 11 }} />
+              <YAxis tick={{ fontSize: 11 }} />
+              <Tooltip />
+              <Legend />
+              <Line type="monotone" dataKey="approved" name="Approved" stroke="#10b981" strokeWidth={2} dot={false} />
+              <Line type="monotone" dataKey="rejected" name="Rejected" stroke="#ef4444" strokeWidth={2} dot={false} />
+              <Line type="monotone" dataKey="deviations" name="Deviations" stroke="#f59e0b" strokeWidth={2} dot={false} />
+            </LineChart>
+          </ResponsiveContainer>
+        </div>
+
+        {/* Decision Distribution */}
+        <div className="bg-white rounded-xl border border-gray-200 p-5">
+          <h2 className="text-base font-semibold text-gray-800 mb-4">Decision Distribution</h2>
+          <ResponsiveContainer width="100%" height={180}>
+            <PieChart>
+              <Pie
+                data={decisionData}
+                cx="50%"
+                cy="50%"
+                innerRadius={50}
+                outerRadius={80}
+                paddingAngle={3}
+                dataKey="value"
+              >
+                {decisionData.map((entry, idx) => (
+                  <Cell key={idx} fill={entry.color} />
+                ))}
+              </Pie>
+              <Tooltip formatter={(v) => `${Number(v).toFixed(1)}%`} />
+            </PieChart>
+          </ResponsiveContainer>
+          <div className="space-y-1 mt-2">
+            {decisionData.map((d) => (
+              <div key={d.name} className="flex items-center justify-between text-sm">
+                <div className="flex items-center gap-2">
+                  <div className="w-3 h-3 rounded-full" style={{ backgroundColor: d.color }} />
+                  <span className="text-gray-600">{d.name}</span>
+                </div>
+                <span className="font-semibold text-gray-800">{d.value?.toFixed(1)}%</span>
+              </div>
+            ))}
+          </div>
+        </div>
+      </div>
+
+      {/* Charts Row 2 */}
+      <div className="grid grid-cols-2 gap-6">
+        {/* Top Rules by Hit Rate */}
+        <div className="bg-white rounded-xl border border-gray-200 p-5">
+          <h2 className="text-base font-semibold text-gray-800 mb-4">Top Rules by Hit Rate</h2>
+          <ResponsiveContainer width="100%" height={220}>
+            <BarChart data={topRules?.slice(0, 8) ?? []} layout="vertical">
+              <CartesianGrid strokeDasharray="3 3" stroke="#f0f0f0" />
+              <XAxis type="number" tick={{ fontSize: 11 }} unit="%" />
+              <YAxis type="category" dataKey="ruleName" tick={{ fontSize: 10 }} width={120} />
+              <Tooltip formatter={(v) => `${Number(v).toFixed(1)}%`} />
+              <Bar dataKey="hitRate" name="Hit Rate" fill="#6366f1" radius={[0, 4, 4, 0]} />
+            </BarChart>
+          </ResponsiveContainer>
+        </div>
+
+        {/* Top Deviations */}
+        <div className="bg-white rounded-xl border border-gray-200 p-5">
+          <h2 className="text-base font-semibold text-gray-800 mb-1">Top Deviations</h2>
+          <p className="text-xs text-gray-400 mb-4">Most frequent policy deviations</p>
+          <div className="space-y-3 max-h-60 overflow-auto">
+            {(deviations ?? []).slice(0, 10).map((d, idx) => (
+              <div key={d.deviationCode} className="flex items-center gap-3">
+                <span className="text-xs font-bold text-gray-400 w-5">{idx + 1}</span>
+                <div className="flex-1">
+                  <div className="flex items-center justify-between">
+                    <span className="text-sm font-medium text-gray-700 truncate">{d.deviationName}</span>
+                    <SeverityBadge severity={d.severity} />
+                  </div>
+                  <div className="mt-1 h-1.5 bg-gray-100 rounded-full overflow-hidden">
+                    <div
+                      className="h-full bg-orange-400 rounded-full"
+                      style={{ width: `${Math.min((d.occurrenceCount / ((deviations?.[0]?.occurrenceCount ?? 1))) * 100, 100)}%` }}
+                    />
+                  </div>
+                </div>
+                <span className="text-xs text-gray-500 font-mono">{d.occurrenceCount}</span>
+              </div>
+            ))}
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function KPICard({
+  label, value, sub, color, icon
+}: {
+  label: string; value: string; sub: string; color: string; icon: string
+}) {
+  const colorMap: Record<string, string> = {
+    blue: 'bg-blue-50 text-blue-700',
+    emerald: 'bg-emerald-50 text-emerald-700',
+    red: 'bg-red-50 text-red-700',
+    amber: 'bg-amber-50 text-amber-700',
+    purple: 'bg-purple-50 text-purple-700',
+    orange: 'bg-orange-50 text-orange-700',
+    teal: 'bg-teal-50 text-teal-700',
+    indigo: 'bg-indigo-50 text-indigo-700',
+  }
+
+  return (
+    <div className="bg-white rounded-xl border border-gray-200 p-4">
+      <div className="flex items-start justify-between">
+        <div>
+          <p className="text-xs text-gray-500 font-medium">{label}</p>
+          <p className="text-2xl font-bold text-gray-900 mt-1">{value}</p>
+          <p className="text-xs text-gray-400 mt-0.5">{sub}</p>
+        </div>
+        <div className={`w-9 h-9 rounded-lg flex items-center justify-center text-lg ${colorMap[color] ?? 'bg-gray-50'}`}>
+          {icon}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function SeverityBadge({ severity }: { severity: string }) {
+  const colors: Record<string, string> = {
+    LOW: 'bg-blue-100 text-blue-700',
+    MEDIUM: 'bg-yellow-100 text-yellow-700',
+    HIGH: 'bg-orange-100 text-orange-700',
+    CRITICAL: 'bg-red-100 text-red-700',
+  }
+  return (
+    <span className={`text-xs px-1.5 py-0.5 rounded font-semibold ${colors[severity] ?? 'bg-gray-100'}`}>
+      {severity}
+    </span>
+  )
+}

DeviationManagementPage.tsx

@@ -0,0 +1,287 @@
+'use client'
+
+import React, { useState } from 'react'
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query'
+import type { PagedResponse } from '@/types'
+import { apiClient } from '@/lib/api-client'
+
+interface DeviationRecord {
+  id: string
+  requestId: string
+  applicationId?: string
+  deviationCode: string
+  deviationName: string
+  severity: 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'
+  reason: string
+  fieldPath?: string
+  actualValue?: string
+  expectedValue?: string
+  recommendedAction?: string
+  isOverridden: boolean
+  overrideReason?: string
+  createdAt: string
+  ruleCode?: string
+}
+
+interface DeviationType {
+  id: string
+  deviationCode: string
+  deviationName: string
+  category: string
+  defaultSeverity: string
+  description: string
+  recommendedAction: string
+  requiresApproval: boolean
+}
+
+const SEVERITY_CONFIG = {
+  LOW: { bg: 'bg-blue-50', text: 'text-blue-700', border: 'border-blue-200', dot: 'bg-blue-500' },
+  MEDIUM: { bg: 'bg-yellow-50', text: 'text-yellow-700', border: 'border-yellow-200', dot: 'bg-yellow-500' },
+  HIGH: { bg: 'bg-orange-50', text: 'text-orange-700', border: 'border-orange-200', dot: 'bg-orange-500' },
+  CRITICAL: { bg: 'bg-red-50', text: 'text-red-700', border: 'border-red-200', dot: 'bg-red-500' },
+}
+
+export function DeviationManagementPage() {
+  const qc = useQueryClient()
+  const [activeTab, setActiveTab] = useState<'live' | 'types'>('live')
+  const [selectedSeverity, setSelectedSeverity] = useState<string>('')
+  const [search, setSearch] = useState('')
+  const [overrideModal, setOverrideModal] = useState<DeviationRecord | null>(null)
+  const [overrideReason, setOverrideReason] = useState('')
+
+  const { data: deviations } = useQuery<PagedResponse<DeviationRecord>>({
+    queryKey: ['deviations', selectedSeverity, search],
+    queryFn: () => apiClient.get('/deviations', { severity: selectedSeverity, search }),
+    refetchInterval: 30_000,
+  })
+
+  const { data: deviationTypes } = useQuery<PagedResponse<DeviationType>>({
+    queryKey: ['deviation-types'],
+    queryFn: () => apiClient.get('/deviation-types'),
+  })
+
+  const overrideMutation = useMutation({
+    mutationFn: ({ id, reason }: { id: string; reason: string }) =>
+      apiClient.post(`/deviations/${id}/override`, { reason }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['deviations'] })
+      setOverrideModal(null)
+      setOverrideReason('')
+    },
+  })
+
+  const stats = {
+    total: deviations?.totalCount ?? 0,
+    critical: deviations?.items.filter((d) => d.severity === 'CRITICAL').length ?? 0,
+    overridden: deviations?.items.filter((d) => d.isOverridden).length ?? 0,
+    pending: deviations?.items.filter((d) => !d.isOverridden).length ?? 0,
+  }
+
+  return (
+    <div className="p-6 space-y-6">
+      <div className="flex items-center justify-between">
+        <div>
+          <h1 className="text-xl font-bold text-gray-900">Deviation Management</h1>
+          <p className="text-sm text-gray-500 mt-0.5">Track, analyze, and override policy deviations</p>
+        </div>
+      </div>
+
+      {/* Stats */}
+      <div className="grid grid-cols-4 gap-4">
+        {[
+          { label: 'Total Deviations', value: stats.total, icon: '📋', color: 'blue' },
+          { label: 'Critical', value: stats.critical, icon: '🚨', color: 'red' },
+          { label: 'Pending Override', value: stats.pending, icon: '⏳', color: 'orange' },
+          { label: 'Overridden', value: stats.overridden, icon: '✅', color: 'emerald' },
+        ].map(({ label, value, icon, color }) => (
+          <div key={label} className="bg-white rounded-xl border border-gray-200 p-4">
+            <div className="flex items-center justify-between">
+              <div>
+                <p className="text-xs text-gray-500">{label}</p>
+                <p className="text-2xl font-bold text-gray-900 mt-1">{value}</p>
+              </div>
+              <div className="text-2xl">{icon}</div>
+            </div>
+          </div>
+        ))}
+      </div>
+
+      {/* Tabs */}
+      <div className="flex border-b border-gray-200">
+        {[
+          { id: 'live', label: 'Live Deviations' },
+          { id: 'types', label: 'Deviation Types' },
+        ].map(({ id, label }) => (
+          <button
+            key={id}
+            onClick={() => setActiveTab(id as any)}
+            className={`py-3 px-6 text-sm font-medium border-b-2 transition-colors ${
+              activeTab === id ? 'border-blue-600 text-blue-600' : 'border-transparent text-gray-500 hover:text-gray-700'
+            }`}
+          >
+            {label}
+          </button>
+        ))}
+      </div>
+
+      {activeTab === 'live' && (
+        <div className="bg-white rounded-xl border border-gray-200">
+          {/* Filters */}
+          <div className="px-5 py-4 border-b border-gray-100 flex items-center gap-3">
+            <input
+              value={search}
+              onChange={(e) => setSearch(e.target.value)}
+              placeholder="Search deviations..."
+              className="flex-1 text-sm border border-gray-200 rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+            />
+            <select
+              value={selectedSeverity}
+              onChange={(e) => setSelectedSeverity(e.target.value)}
+              className="text-sm border border-gray-200 rounded-lg px-3 py-2"
+            >
+              <option value="">All Severities</option>
+              {['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'].map((s) => (
+                <option key={s} value={s}>{s}</option>
+              ))}
+            </select>
+          </div>
+
+          {/* Table */}
+          <div className="overflow-auto">
+            <table className="w-full text-sm">
+              <thead>
+                <tr className="text-left text-xs font-semibold text-gray-500 uppercase border-b border-gray-100">
+                  <th className="px-5 py-3">Deviation</th>
+                  <th className="px-5 py-3">Severity</th>
+                  <th className="px-5 py-3">Application</th>
+                  <th className="px-5 py-3">Actual Value</th>
+                  <th className="px-5 py-3">Reason</th>
+                  <th className="px-5 py-3">Status</th>
+                  <th className="px-5 py-3">Action</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y divide-gray-50">
+                {deviations?.items.map((d) => {
+                  const sc = SEVERITY_CONFIG[d.severity]
+                  return (
+                    <tr key={d.id} className={`hover:bg-gray-50 ${d.severity === 'CRITICAL' ? 'bg-red-50/30' : ''}`}>
+                      <td className="px-5 py-3">
+                        <div className="font-medium text-gray-800">{d.deviationName}</div>
+                        <div className="text-xs text-gray-400 font-mono">{d.deviationCode}</div>
+                      </td>
+                      <td className="px-5 py-3">
+                        <span className={`inline-flex items-center gap-1.5 px-2.5 py-1 rounded-full text-xs font-semibold ${sc.bg} ${sc.text} border ${sc.border}`}>
+                          <span className={`w-1.5 h-1.5 rounded-full ${sc.dot}`} />
+                          {d.severity}
+                        </span>
+                      </td>
+                      <td className="px-5 py-3 font-mono text-xs text-gray-600">{d.applicationId ?? '—'}</td>
+                      <td className="px-5 py-3">
+                        {d.fieldPath && (
+                          <div>
+                            <div className="text-xs text-gray-400">{d.fieldPath}</div>
+                            <div className="font-mono text-red-600 font-medium">{d.actualValue ?? '—'}</div>
+                          </div>
+                        )}
+                      </td>
+                      <td className="px-5 py-3 text-xs text-gray-600 max-w-48 truncate">{d.reason}</td>
+                      <td className="px-5 py-3">
+                        {d.isOverridden ? (
+                          <span className="text-xs bg-emerald-100 text-emerald-700 px-2 py-1 rounded-full font-medium">Overridden</span>
+                        ) : (
+                          <span className="text-xs bg-amber-100 text-amber-700 px-2 py-1 rounded-full font-medium">Pending</span>
+                        )}
+                      </td>
+                      <td className="px-5 py-3">
+                        {!d.isOverridden && (
+                          <button
+                            onClick={() => setOverrideModal(d)}
+                            className="text-xs text-blue-600 hover:text-blue-700 font-medium"
+                          >
+                            Override
+                          </button>
+                        )}
+                      </td>
+                    </tr>
+                  )
+                })}
+              </tbody>
+            </table>
+          </div>
+        </div>
+      )}
+
+      {activeTab === 'types' && (
+        <div className="grid grid-cols-2 gap-4">
+          {deviationTypes?.items.map((dt) => {
+            const sc = SEVERITY_CONFIG[dt.defaultSeverity as keyof typeof SEVERITY_CONFIG] ?? SEVERITY_CONFIG.MEDIUM
+            return (
+              <div key={dt.id} className={`rounded-xl border-2 p-4 ${sc.border} ${sc.bg}`}>
+                <div className="flex items-center justify-between mb-2">
+                  <div className="font-semibold text-gray-800">{dt.deviationName}</div>
+                  <span className={`text-xs px-2 py-0.5 rounded-full font-semibold ${sc.text} bg-white`}>
+                    {dt.defaultSeverity}
+                  </span>
+                </div>
+                <div className="text-xs font-mono text-gray-500 mb-2">{dt.deviationCode}</div>
+                <div className="text-sm text-gray-600 mb-3">{dt.description}</div>
+                {dt.recommendedAction && (
+                  <div className="flex items-start gap-1.5 text-xs text-gray-500">
+                    <span>💡</span>
+                    <span>{dt.recommendedAction}</span>
+                  </div>
+                )}
+                {dt.requiresApproval && (
+                  <div className="mt-2 text-xs text-amber-600 font-medium">⚠ Requires approval</div>
+                )}
+              </div>
+            )
+          })}
+        </div>
+      )}
+
+      {/* Override Modal */}
+      {overrideModal && (
+        <div className="fixed inset-0 bg-black/50 z-50 flex items-center justify-center p-4">
+          <div className="bg-white rounded-2xl shadow-2xl w-full max-w-md">
+            <div className="px-6 py-5 border-b border-gray-100">
+              <h2 className="text-lg font-bold text-gray-900">Override Deviation</h2>
+              <p className="text-sm text-gray-500 mt-1">{overrideModal.deviationName}</p>
+            </div>
+            <div className="px-6 py-5 space-y-4">
+              <div className="bg-amber-50 border border-amber-200 rounded-xl p-4 text-sm text-amber-800">
+                <p className="font-semibold mb-1">⚠ Override Reason Required</p>
+                <p>You must provide a valid business justification for overriding this deviation. This action will be logged in the audit trail.</p>
+              </div>
+              <div>
+                <label className="text-sm font-medium text-gray-700 block mb-1">Business Justification</label>
+                <textarea
+                  value={overrideReason}
+                  onChange={(e) => setOverrideReason(e.target.value)}
+                  rows={4}
+                  placeholder="Enter detailed reason for overriding this deviation..."
+                  className="w-full text-sm border border-gray-200 rounded-xl px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500 resize-none"
+                />
+              </div>
+            </div>
+            <div className="px-6 py-4 border-t border-gray-100 flex gap-3">
+              <button
+                onClick={() => { setOverrideModal(null); setOverrideReason('') }}
+                className="flex-1 px-4 py-2 border border-gray-200 rounded-lg text-sm font-medium text-gray-700 hover:bg-gray-50"
+              >
+                Cancel
+              </button>
+              <button
+                onClick={() => overrideMutation.mutate({ id: overrideModal.id, reason: overrideReason })}
+                disabled={!overrideReason.trim() || overrideMutation.isPending}
+                className="flex-1 px-4 py-2 bg-blue-600 text-white rounded-lg text-sm font-semibold hover:bg-blue-700 disabled:opacity-50"
+              >
+                {overrideMutation.isPending ? 'Saving...' : 'Confirm Override'}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}

Dockerfile.backend

@@ -0,0 +1,84 @@
+# ==============================================================
+# OPTIM AI BRE Engine — Backend Dockerfile
+# .NET 8 multi-stage production build
+# ==============================================================
+
+ARG PROJECT=OptimAI.BRE.Gateway
+
+# ---- STAGE 1: RESTORE ----------------------------------------
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS restore
+ARG PROJECT
+WORKDIR /src
+
+COPY ["OptimAI.BRE.Shared/OptimAI.BRE.Shared.csproj",           "OptimAI.BRE.Shared/"]
+COPY ["OptimAI.BRE.RuleEngine/OptimAI.BRE.RuleEngine.csproj",   "OptimAI.BRE.RuleEngine/"]
+COPY ["OptimAI.BRE.RuleDesigner/OptimAI.BRE.RuleDesigner.csproj","OptimAI.BRE.RuleDesigner/"]
+COPY ["OptimAI.BRE.AIEngine/OptimAI.BRE.AIEngine.csproj",       "OptimAI.BRE.AIEngine/"]
+COPY ["OptimAI.BRE.ClientMgmt/OptimAI.BRE.ClientMgmt.csproj",   "OptimAI.BRE.ClientMgmt/"]
+COPY ["OptimAI.BRE.AuditService/OptimAI.BRE.AuditService.csproj","OptimAI.BRE.AuditService/"]
+COPY ["OptimAI.BRE.ReportService/OptimAI.BRE.ReportService.csproj","OptimAI.BRE.ReportService/"]
+COPY ["OptimAI.BRE.IdentityService/OptimAI.BRE.IdentityService.csproj","OptimAI.BRE.IdentityService/"]
+COPY ["OptimAI.BRE.Gateway/OptimAI.BRE.Gateway.csproj",         "OptimAI.BRE.Gateway/"]
+COPY ["OptimAI.BRE.sln", "./"]
+
+RUN dotnet restore "OptimAI.BRE.Gateway/OptimAI.BRE.Gateway.csproj" \
+    --runtime linux-x64
+
+# ---- STAGE 2: BUILD ------------------------------------------
+FROM restore AS build
+ARG PROJECT
+COPY . .
+
+RUN dotnet build "${PROJECT}/${PROJECT}.csproj" \
+    -c Release \
+    --no-restore \
+    --runtime linux-x64 \
+    --self-contained false \
+    -o /app/build
+
+# ---- STAGE 3: PUBLISH ----------------------------------------
+FROM build AS publish
+ARG PROJECT
+
+RUN dotnet publish "${PROJECT}/${PROJECT}.csproj" \
+    -c Release \
+    --no-restore \
+    --runtime linux-x64 \
+    --self-contained false \
+    /p:UseAppHost=false \
+    -o /app/publish
+
+# ---- STAGE 4: RUNTIME ----------------------------------------
+FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine AS runtime
+
+# Install curl + tz data (for healthcheck and IST timezone)
+RUN apk add --no-cache curl tzdata && \
+    cp /usr/share/zoneinfo/Asia/Kolkata /etc/localtime && \
+    echo "Asia/Kolkata" > /etc/timezone && \
+    apk del tzdata
+
+# Non-root security
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+
+WORKDIR /app
+
+COPY --from=publish --chown=appuser:appgroup /app/publish .
+
+# Persistent log directory
+RUN mkdir -p /app/logs /app/reports && \
+    chown -R appuser:appgroup /app/logs /app/reports
+
+USER appuser
+
+ENV ASPNETCORE_URLS=http://+:8080 \
+    ASPNETCORE_ENVIRONMENT=Production \
+    DOTNET_RUNNING_IN_CONTAINER=true \
+    DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false \
+    TZ=Asia/Kolkata
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=5 \
+    CMD curl -f http://localhost:8080/health || exit 1
+
+ENTRYPOINT ["dotnet", "OptimAI.BRE.Gateway.dll"]

Dockerfile.frontend

@@ -0,0 +1,63 @@
+# ==============================================================
+# OPTIM AI BRE Engine — Frontend Dockerfile
+# Next.js 14 standalone multi-stage production build
+# ==============================================================
+
+# ---- STAGE 1: BASE -------------------------------------------
+FROM node:20-alpine AS base
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+
+# ---- STAGE 2: DEPENDENCIES -----------------------------------
+FROM base AS deps
+COPY package.json package-lock.json* ./
+
+# Install ALL deps (including dev) — needed for build
+RUN npm ci --ignore-scripts && \
+    npm cache clean --force
+
+# ---- STAGE 3: BUILD ------------------------------------------
+FROM base AS builder
+WORKDIR /app
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+# NEXT_PUBLIC_API_URL is baked at build time.
+# /api/v1 is a relative URL — Nginx proxies it to the backend container.
+# This means the same Docker image works for any domain or server IP.
+ARG NEXT_PUBLIC_API_URL=/api/v1
+ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL \
+    NEXT_TELEMETRY_DISABLED=1 \
+    NODE_ENV=production
+
+RUN npm run build
+
+# ---- STAGE 4: RUNNER -----------------------------------------
+FROM node:20-alpine AS runner
+WORKDIR /app
+
+RUN apk add --no-cache wget
+
+ENV NODE_ENV=production \
+    NEXT_TELEMETRY_DISABLED=1 \
+    PORT=3000 \
+    HOSTNAME="0.0.0.0"
+
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+# Copy Next.js standalone output
+COPY --from=builder /app/public ./public
+RUN mkdir -p .next && chown nextjs:nodejs .next
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+    CMD wget -qO- http://localhost:3000/api/health || exit 1
+
+CMD ["node", "server.js"]

Entities.cs

@@ -0,0 +1,454 @@
+using System;
+using System.Collections.Generic;
+
+namespace OptimAI.BRE.Shared.Domain;
+
+// ============================================================
+// BASE ENTITIES
+// ============================================================
+
+public abstract class BaseEntity
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+    public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
+}
+
+public abstract class TenantEntity : BaseEntity
+{
+    public Guid TenantId { get; set; }
+}
+
+// ============================================================
+// TENANT
+// ============================================================
+
+public class Tenant : BaseEntity
+{
+    public string TenantCode { get; set; } = default!;
+    public string TenantName { get; set; } = default!;
+    public string? DisplayName { get; set; }
+    public string? LogoUrl { get; set; }
+    public string PrimaryColor { get; set; } = "#1E40AF";
+    public string SecondaryColor { get; set; } = "#3B82F6";
+    public PlanType PlanType { get; set; } = PlanType.Enterprise;
+    public int MaxRules { get; set; } = 1000;
+    public long MaxExecutionsPerDay { get; set; } = 1_000_000;
+    public bool IsActive { get; set; } = true;
+    public DateTime? TrialEndDate { get; set; }
+    public DateTime? SubscriptionEndDate { get; set; }
+    public Dictionary<string, object> Settings { get; set; } = new();
+
+    public ICollection<User> Users { get; set; } = new List<User>();
+    public ICollection<Rule> Rules { get; set; } = new List<Rule>();
+}
+
+public enum PlanType { Starter, Professional, Enterprise }
+
+// ============================================================
+// IDENTITY
+// ============================================================
+
+public class User : TenantEntity
+{
+    public string Email { get; set; } = default!;
+    public string Username { get; set; } = default!;
+    public string PasswordHash { get; set; } = default!;
+    public string FullName { get; set; } = default!;
+    public string? EmployeeId { get; set; }
+    public string? Designation { get; set; }
+    public string? Department { get; set; }
+    public string? Mobile { get; set; }
+    public string? ProfileImageUrl { get; set; }
+    public bool IsActive { get; set; } = true;
+    public bool IsEmailVerified { get; set; }
+    public bool IsMfaEnabled { get; set; }
+    public string? MfaSecret { get; set; }
+    public DateTime? LastLoginAt { get; set; }
+    public string? LastLoginIp { get; set; }
+    public int FailedLoginCount { get; set; }
+    public DateTime? LockedUntil { get; set; }
+    public DateTime? PasswordChangedAt { get; set; }
+
+    public Tenant Tenant { get; set; } = default!;
+    public ICollection<UserRole> UserRoles { get; set; } = new List<UserRole>();
+}
+
+public class Role : TenantEntity
+{
+    public string RoleCode { get; set; } = default!;
+    public string RoleName { get; set; } = default!;
+    public string? Description { get; set; }
+    public bool IsSystemRole { get; set; }
+    public bool IsActive { get; set; } = true;
+
+    public ICollection<RolePermission> RolePermissions { get; set; } = new List<RolePermission>();
+    public ICollection<UserRole> UserRoles { get; set; } = new List<UserRole>();
+}
+
+public class Permission : BaseEntity
+{
+    public string PermissionCode { get; set; } = default!;
+    public string PermissionName { get; set; } = default!;
+    public string Module { get; set; } = default!;
+    public string? Description { get; set; }
+}
+
+public class RolePermission
+{
+    public Guid RoleId { get; set; }
+    public Guid PermissionId { get; set; }
+    public DateTime GrantedAt { get; set; } = DateTime.UtcNow;
+    public Guid? GrantedBy { get; set; }
+    public Role Role { get; set; } = default!;
+    public Permission Permission { get; set; } = default!;
+}
+
+public class UserRole
+{
+    public Guid UserId { get; set; }
+    public Guid RoleId { get; set; }
+    public DateTime AssignedAt { get; set; } = DateTime.UtcNow;
+    public Guid? AssignedBy { get; set; }
+    public User User { get; set; } = default!;
+    public Role Role { get; set; } = default!;
+}
+
+public class ApiKey : TenantEntity
+{
+    public string KeyName { get; set; } = default!;
+    public string ApiKeyHash { get; set; } = default!;
+    public string ApiKeyPrefix { get; set; } = default!;
+    public List<string> Scopes { get; set; } = new();
+    public bool IsActive { get; set; } = true;
+    public DateTime? ExpiresAt { get; set; }
+    public DateTime? LastUsedAt { get; set; }
+    public int RateLimitPerMinute { get; set; } = 1000;
+    public Guid CreatedBy { get; set; }
+}
+
+// ============================================================
+// RULE ENGINE CORE
+// ============================================================
+
+public class Rule : TenantEntity
+{
+    public string RuleCode { get; set; } = default!;
+    public string RuleName { get; set; } = default!;
+    public string? Description { get; set; }
+    public Guid? CategoryId { get; set; }
+    public RuleType RuleType { get; set; }
+    public int Priority { get; set; } = 100;
+    public bool IsActive { get; set; } = true;
+    public bool IsPublished { get; set; }
+    public bool IsDraft { get; set; } = true;
+    public RuleStatus Status { get; set; } = RuleStatus.Draft;
+    public Guid? CurrentVersionId { get; set; }
+    public List<string> Tags { get; set; } = new();
+    public Guid CreatedBy { get; set; }
+
+    public RuleCategory? Category { get; set; }
+    public RuleVersion? CurrentVersion { get; set; }
+    public ICollection<RuleVersion> Versions { get; set; } = new List<RuleVersion>();
+    public ICollection<RuleScope> Scopes { get; set; } = new List<RuleScope>();
+}
+
+public enum RuleType
+{
+    Eligibility, Credit, Bureau, FI, Valuation,
+    Fraud, Compliance, Deviation, Income, Kyc,
+    Vehicle, Guarantor, CollateralCheck
+}
+
+public enum RuleStatus { Draft, PendingApproval, Approved, Published, Archived }
+
+public class RuleVersion : TenantEntity
+{
+    public Guid RuleId { get; set; }
+    public int VersionNumber { get; set; }
+    public string? VersionLabel { get; set; }
+    public RuleDefinition RuleDefinition { get; set; } = default!;
+    public string? ChangeSummary { get; set; }
+    public bool IsCurrent { get; set; }
+    public RuleStatus Status { get; set; } = RuleStatus.Draft;
+    public Guid? ApprovedBy { get; set; }
+    public DateTime? ApprovedAt { get; set; }
+    public Guid? PublishedBy { get; set; }
+    public DateTime? PublishedAt { get; set; }
+    public Guid CreatedBy { get; set; }
+
+    public Rule Rule { get; set; } = default!;
+}
+
+public class RuleDefinition
+{
+    public ConditionGroup Conditions { get; set; } = default!;
+    public List<RuleAction> Actions { get; set; } = new();
+    public RuleMetadata Metadata { get; set; } = new();
+}
+
+public class ConditionGroup
+{
+    public string Id { get; set; } = Guid.NewGuid().ToString();
+    public LogicalOperator Operator { get; set; } = LogicalOperator.And;
+    public List<ConditionNode> Rules { get; set; } = new();
+}
+
+public class ConditionNode
+{
+    public string Id { get; set; } = Guid.NewGuid().ToString();
+    public bool IsGroup { get; set; }
+    // When IsGroup = false (leaf condition)
+    public string? Field { get; set; }
+    public ComparisonOperator? Operator { get; set; }
+    public object? Value { get; set; }
+    public string? Value2 { get; set; }  // for BETWEEN
+    public ValueType ValueType { get; set; } = ValueType.Literal;
+    public string? ReferenceField { get; set; }  // for FIELD_COMPARE
+    public string? CustomFunction { get; set; }
+    // When IsGroup = true
+    public ConditionGroup? Group { get; set; }
+}
+
+public enum LogicalOperator { And, Or, Not }
+
+public enum ComparisonOperator
+{
+    Equals, NotEquals,
+    GreaterThan, GreaterThanOrEqual,
+    LessThan, LessThanOrEqual,
+    Between, NotBetween,
+    In, NotIn,
+    Contains, NotContains,
+    StartsWith, EndsWith,
+    IsNull, IsNotNull,
+    IsTrue, IsFalse,
+    Regex, FieldCompare
+}
+
+public enum ValueType { Literal, Field, Function, Expression }
+
+public class RuleAction
+{
+    public string Id { get; set; } = Guid.NewGuid().ToString();
+    public ActionType Type { get; set; }
+    public string? Value { get; set; }
+    public string? Field { get; set; }
+    public Dictionary<string, string> Parameters { get; set; } = new();
+}
+
+public enum ActionType
+{
+    SetDecision,
+    SetRisk,
+    SetTrafficLight,
+    AddDeviation,
+    SetField,
+    SendNotification,
+    TriggerWorkflow,
+    AddTag,
+    SetScore
+}
+
+public class RuleMetadata
+{
+    public int ExecutionOrder { get; set; } = 0;
+    public bool StopOnMatch { get; set; } = false;
+    public ErrorHandling ErrorHandling { get; set; } = ErrorHandling.Skip;
+    public string? Notes { get; set; }
+}
+
+public enum ErrorHandling { Skip, Fail, UseDefault }
+
+public class RuleScope : TenantEntity
+{
+    public Guid RuleId { get; set; }
+    public ScopeType ScopeType { get; set; }
+    public string ScopeValue { get; set; } = default!;
+    public bool IsExcluded { get; set; }
+    public Rule Rule { get; set; } = default!;
+}
+
+public enum ScopeType { Product, Branch, Stage, UserRole, Global }
+
+public class RuleCategory : TenantEntity
+{
+    public string CategoryCode { get; set; } = default!;
+    public string CategoryName { get; set; } = default!;
+    public string? Description { get; set; }
+    public string? Icon { get; set; }
+    public int SortOrder { get; set; }
+    public bool IsActive { get; set; } = true;
+}
+
+public class RuleSet : TenantEntity
+{
+    public string SetCode { get; set; } = default!;
+    public string SetName { get; set; } = default!;
+    public string? Description { get; set; }
+    public ExecutionMode ExecutionMode { get; set; } = ExecutionMode.All;
+    public bool IsActive { get; set; } = true;
+    public Guid CreatedBy { get; set; }
+
+    public ICollection<RuleSetMember> Members { get; set; } = new List<RuleSetMember>();
+}
+
+public enum ExecutionMode { All, FirstMatch, Scored }
+
+public class RuleSetMember
+{
+    public Guid SetId { get; set; }
+    public Guid RuleId { get; set; }
+    public int SortOrder { get; set; }
+    public decimal Weight { get; set; } = 1.0m;
+    public RuleSet RuleSet { get; set; } = default!;
+    public Rule Rule { get; set; } = default!;
+}
+
+// ============================================================
+// EXECUTION
+// ============================================================
+
+public class ExecutionRequest : TenantEntity
+{
+    public string? CorrelationId { get; set; }
+    public string? ApplicationId { get; set; }
+    public string? ProductCode { get; set; }
+    public string? BranchCode { get; set; }
+    public string? StageCode { get; set; }
+    public Guid? RuleSetId { get; set; }
+    public Dictionary<string, object> InputPayload { get; set; } = new();
+    public string? InputHash { get; set; }
+    public ExecutionStatus Status { get; set; } = ExecutionStatus.Pending;
+    public int Priority { get; set; } = 5;
+    public string? SourceSystem { get; set; }
+    public Guid? ApiKeyId { get; set; }
+    public DateTime? ProcessingStartedAt { get; set; }
+    public DateTime? CompletedAt { get; set; }
+    public int? ProcessingMs { get; set; }
+}
+
+public enum ExecutionStatus { Pending, Processing, Completed, Failed }
+
+public class ExecutionResult : TenantEntity
+{
+    public Guid RequestId { get; set; }
+    public Decision FinalDecision { get; set; }
+    public decimal? RiskScore { get; set; }
+    public RiskCategory? RiskCategory { get; set; }
+    public TrafficLight? TrafficLight { get; set; }
+    public int TotalRulesEvaluated { get; set; }
+    public int RulesPassed { get; set; }
+    public int RulesFailed { get; set; }
+    public int RulesSkipped { get; set; }
+    public int DeviationsCount { get; set; }
+    public int? ExecutionMs { get; set; }
+    public List<RuleExecutionSummary> RuleResults { get; set; } = new();
+    public Dictionary<string, object> FieldValues { get; set; } = new();
+    public string? AiSummary { get; set; }
+    public AiAnalysis? AiAnalysis { get; set; }
+}
+
+public enum Decision { Approve, Reject, Deviation, Refer, Pending }
+public enum RiskCategory { Low, Medium, High, Critical }
+public enum TrafficLight { Green, Amber, Red }
+
+public class RuleExecutionSummary
+{
+    public Guid RuleId { get; set; }
+    public string RuleCode { get; set; } = default!;
+    public string RuleName { get; set; } = default!;
+    public int VersionNumber { get; set; }
+    public bool IsMatched { get; set; }
+    public List<ConditionEvaluationResult> ConditionsEvaluated { get; set; } = new();
+    public List<string> ActionsExecuted { get; set; } = new();
+    public int? ExecutionMs { get; set; }
+    public string? ErrorMessage { get; set; }
+}
+
+public class ConditionEvaluationResult
+{
+    public string ConditionId { get; set; } = default!;
+    public string Field { get; set; } = default!;
+    public string Operator { get; set; } = default!;
+    public object? ExpectedValue { get; set; }
+    public object? ActualValue { get; set; }
+    public bool Result { get; set; }
+}
+
+public class AiAnalysis
+{
+    public string RiskSummary { get; set; } = default!;
+    public string CreditSummary { get; set; } = default!;
+    public List<string> Strengths { get; set; } = new();
+    public List<string> Weaknesses { get; set; } = new();
+    public string DeviationsSummary { get; set; } = default!;
+    public string ApprovalRecommendation { get; set; } = default!;
+    public List<string> RejectionReasons { get; set; } = new();
+    public List<string> AdditionalDocuments { get; set; } = new();
+    public string UnderwritingNotes { get; set; } = default!;
+    public double ConfidenceScore { get; set; }
+}
+
+// ============================================================
+// DEVIATIONS
+// ============================================================
+
+public class DeviationType : TenantEntity
+{
+    public string DeviationCode { get; set; } = default!;
+    public string DeviationName { get; set; } = default!;
+    public string? Category { get; set; }
+    public Severity DefaultSeverity { get; set; } = Severity.Medium;
+    public string? Description { get; set; }
+    public string? RecommendedAction { get; set; }
+    public bool RequiresApproval { get; set; }
+    public string? ApproverRole { get; set; }
+    public bool IsActive { get; set; } = true;
+}
+
+public enum Severity { Low, Medium, High, Critical }
+
+public class ExecutionDeviation
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    public Guid ResultId { get; set; }
+    public Guid? RuleId { get; set; }
+    public Guid? DeviationTypeId { get; set; }
+    public string DeviationCode { get; set; } = default!;
+    public string DeviationName { get; set; } = default!;
+    public Severity Severity { get; set; }
+    public string Reason { get; set; } = default!;
+    public string? FieldPath { get; set; }
+    public string? ActualValue { get; set; }
+    public string? ExpectedValue { get; set; }
+    public string? RecommendedAction { get; set; }
+    public bool IsOverridden { get; set; }
+    public Guid? OverriddenBy { get; set; }
+    public string? OverrideReason { get; set; }
+    public DateTime? OverrideAt { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+    public Guid TenantId { get; set; }
+}
+
+// ============================================================
+// AUDIT
+// ============================================================
+
+public class AuditLog
+{
+    public Guid Id { get; set; } = Guid.NewGuid();
+    public Guid TenantId { get; set; }
+    public Guid? UserId { get; set; }
+    public string Action { get; set; } = default!;
+    public string EntityType { get; set; } = default!;
+    public string? EntityId { get; set; }
+    public Dictionary<string, object>? OldValues { get; set; }
+    public Dictionary<string, object>? NewValues { get; set; }
+    public string? IpAddress { get; set; }
+    public string? UserAgent { get; set; }
+    public string? RequestId { get; set; }
+    public bool IsSuccess { get; set; } = true;
+    public string? ErrorMessage { get; set; }
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+}

IRuleExecutionService.cs

@@ -0,0 +1,217 @@
+using OptimAI.BRE.Shared.Domain;
+using System.Text.Json.Nodes;
+
+namespace OptimAI.BRE.RuleEngine.Domain;
+
+public interface IRuleExecutionService
+{
+    Task<ExecutionResult> ExecuteAsync(ExecutionContext context, CancellationToken ct = default);
+    Task<RuleEvaluationResult> EvaluateRuleAsync(Rule rule, ExecutionContext context, CancellationToken ct = default);
+    Task<bool> EvaluateConditionGroupAsync(ConditionGroup group, DynamicDataContext data, CancellationToken ct = default);
+}
+
+public interface IRuleLoader
+{
+    Task<IReadOnlyList<Rule>> LoadRulesAsync(RuleLoadRequest request, CancellationToken ct = default);
+    Task<Rule?> LoadRuleByCodeAsync(Guid tenantId, string ruleCode, CancellationToken ct = default);
+}
+
+public interface IDynamicFieldResolver
+{
+    object? Resolve(string fieldPath, DynamicDataContext context);
+    bool TryResolve(string fieldPath, DynamicDataContext context, out object? value);
+}
+
+public interface IConditionEvaluator
+{
+    bool Evaluate(ConditionNode condition, DynamicDataContext context);
+}
+
+public interface IActionExecutor
+{
+    Task ExecuteAsync(RuleAction action, ExecutionContext context, RuleExecutionState state);
+}
+
+public interface IRiskScoringEngine
+{
+    Task<RiskScoreResult> CalculateAsync(ExecutionContext context, List<RuleEvaluationResult> results);
+}
+
+// ============================================================
+// EXECUTION CONTEXT & STATE
+// ============================================================
+
+public class ExecutionContext
+{
+    public Guid TenantId { get; set; }
+    public string? CorrelationId { get; set; }
+    public string? ApplicationId { get; set; }
+    public string? ProductCode { get; set; }
+    public string? BranchCode { get; set; }
+    public string? StageCode { get; set; }
+    public string? SourceSystem { get; set; }
+    public Guid? RuleSetId { get; set; }
+    public DynamicDataContext Data { get; set; } = default!;
+    public ExecutionOptions Options { get; set; } = new();
+    public Guid? RequestedBy { get; set; }
+}
+
+public class ExecutionOptions
+{
+    public bool EnableAiAnalysis { get; set; } = true;
+    public bool EnableRiskScoring { get; set; } = true;
+    public bool StopOnFirstReject { get; set; } = false;
+    public int TimeoutMs { get; set; } = 5000;
+    public bool IncludeConditionDetails { get; set; } = true;
+    public bool EnableCaching { get; set; } = true;
+}
+
+public class DynamicDataContext
+{
+    private readonly JsonObject _root;
+
+    public DynamicDataContext(Dictionary<string, object> data)
+    {
+        _root = ConvertToJsonObject(data);
+    }
+
+    public DynamicDataContext(JsonObject root)
+    {
+        _root = root;
+    }
+
+    public object? GetValue(string path)
+    {
+        var parts = path.Split('.');
+        JsonNode? current = _root;
+
+        foreach (var part in parts)
+        {
+            if (current is JsonObject obj)
+            {
+                if (!obj.TryGetPropertyValue(part, out current) || current == null)
+                    return null;
+            }
+            else if (current is JsonArray arr && int.TryParse(part, out var idx))
+            {
+                current = idx < arr.Count ? arr[idx] : null;
+            }
+            else
+            {
+                return null;
+            }
+        }
+
+        return ExtractValue(current);
+    }
+
+    public bool SetValue(string path, object value)
+    {
+        var parts = path.Split('.');
+        JsonObject? current = _root;
+
+        for (int i = 0; i < parts.Length - 1; i++)
+        {
+            if (current == null) return false;
+            if (!current.TryGetPropertyValue(parts[i], out var next) || next is not JsonObject nextObj)
+            {
+                nextObj = new JsonObject();
+                current[parts[i]] = nextObj;
+            }
+            current = nextObj as JsonObject;
+        }
+
+        if (current == null) return false;
+        current[parts[^1]] = JsonValue.Create(value);
+        return true;
+    }
+
+    public Dictionary<string, object> ToDictionary()
+    {
+        var result = new Dictionary<string, object>();
+        FlattenJsonObject(_root, "", result);
+        return result;
+    }
+
+    private static object? ExtractValue(JsonNode? node) => node switch
+    {
+        JsonValue v when v.TryGetValue<decimal>(out var d) => d,
+        JsonValue v when v.TryGetValue<bool>(out var b) => b,
+        JsonValue v when v.TryGetValue<string>(out var s) => s,
+        JsonValue v when v.TryGetValue<DateTime>(out var dt) => dt,
+        JsonArray arr => arr.Select(ExtractValue).ToList(),
+        JsonObject obj => obj.ToDictionary(kv => kv.Key, kv => ExtractValue(kv.Value)!),
+        null => null,
+        _ => node.ToString()
+    };
+
+    private static JsonObject ConvertToJsonObject(Dictionary<string, object> data)
+    {
+        var json = System.Text.Json.JsonSerializer.Serialize(data);
+        return JsonNode.Parse(json) as JsonObject ?? new JsonObject();
+    }
+
+    private static void FlattenJsonObject(JsonObject obj, string prefix, Dictionary<string, object> result)
+    {
+        foreach (var kv in obj)
+        {
+            var key = string.IsNullOrEmpty(prefix) ? kv.Key : $"{prefix}.{kv.Key}";
+            if (kv.Value is JsonObject nested)
+                FlattenJsonObject(nested, key, result);
+            else if (kv.Value != null)
+                result[key] = ExtractValue(kv.Value)!;
+        }
+    }
+}
+
+public class ExecutionState
+{
+    public Decision CurrentDecision { get; set; } = Decision.Pending;
+    public decimal RiskScore { get; set; } = 50m;
+    public TrafficLight TrafficLight { get; set; } = TrafficLight.Amber;
+    public List<ExecutionDeviation> Deviations { get; set; } = new();
+    public List<string> Tags { get; set; } = new();
+    public Dictionary<string, object> OutputFields { get; set; } = new();
+    public bool ShouldStop { get; set; }
+}
+
+public class RuleExecutionState
+{
+    public ExecutionState GlobalState { get; set; } = default!;
+    public DynamicDataContext Data { get; set; } = default!;
+    public Guid TenantId { get; set; }
+}
+
+public class RuleEvaluationResult
+{
+    public Guid RuleId { get; set; }
+    public string RuleCode { get; set; } = default!;
+    public string RuleName { get; set; } = default!;
+    public int VersionNumber { get; set; }
+    public int ExecutionOrder { get; set; }
+    public bool IsMatched { get; set; }
+    public bool HasError { get; set; }
+    public string? ErrorMessage { get; set; }
+    public List<ConditionEvaluationResult> ConditionResults { get; set; } = new();
+    public List<string> ExecutedActions { get; set; } = new();
+    public int ExecutionMs { get; set; }
+}
+
+public class RuleLoadRequest
+{
+    public Guid TenantId { get; set; }
+    public string? ProductCode { get; set; }
+    public string? BranchCode { get; set; }
+    public string? StageCode { get; set; }
+    public Guid? RuleSetId { get; set; }
+    public List<RuleType> RuleTypes { get; set; } = new();
+    public bool PublishedOnly { get; set; } = true;
+}
+
+public class RiskScoreResult
+{
+    public decimal Score { get; set; }
+    public RiskCategory Category { get; set; }
+    public TrafficLight TrafficLight { get; set; }
+    public Dictionary<string, decimal> ComponentScores { get; set; } = new();
+}

OptimAI.BRE.AuditService.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.AuditService</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.RuleEngine\OptimAI.BRE.RuleEngine.csproj" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.ClientMgmt.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.ClientMgmt</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.RuleEngine\OptimAI.BRE.RuleEngine.csproj" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.Gateway.csproj

@@ -0,0 +1,58 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.Gateway</RootNamespace>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <NoWarn>$(NoWarn);1591</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Core ASP.NET & EF -->
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.1" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.1">
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+      <PrivateAssets>all</PrivateAssets>
+    </PackageReference>
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.2" />
+    <PackageReference Include="EFCore.NamingConventions" Version="8.0.3" />
+
+    <!-- Authentication -->
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.1" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="7.3.1" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.3.1" />
+    <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
+
+    <!-- Redis -->
+    <PackageReference Include="StackExchange.Redis" Version="2.7.17" />
+    <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="8.0.1" />
+
+    <!-- Azure OpenAI -->
+    <PackageReference Include="Azure.AI.OpenAI" Version="1.0.0-beta.17" />
+
+    <!-- Logging -->
+    <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
+    <PackageReference Include="Serilog.Sinks.Console" Version="5.0.1" />
+    <PackageReference Include="Serilog.Sinks.File" Version="5.0.0" />
+    <PackageReference Include="Serilog.Enrichers.Environment" Version="2.3.0" />
+
+    <!-- Swagger -->
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.5.0" />
+
+    <!-- Health Checks -->
+    <PackageReference Include="AspNetCore.HealthChecks.NpgSql" Version="8.0.1" />
+    <PackageReference Include="AspNetCore.HealthChecks.Redis" Version="8.0.1" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.RuleEngine\OptimAI.BRE.RuleEngine.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.RuleDesigner\OptimAI.BRE.RuleDesigner.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.AIEngine\OptimAI.BRE.AIEngine.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.IdentityService\OptimAI.BRE.IdentityService.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.ClientMgmt\OptimAI.BRE.ClientMgmt.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.AuditService\OptimAI.BRE.AuditService.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.ReportService\OptimAI.BRE.ReportService.csproj" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.IdentityService.csproj

@@ -0,0 +1,20 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.IdentityService</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.2.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.1" />
+    <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="7.3.1" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.3.1" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.RuleEngine\OptimAI.BRE.RuleEngine.csproj" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.ReportService.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.ReportService</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.RuleEngine\OptimAI.BRE.RuleEngine.csproj" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.RuleDesigner.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.RuleDesigner</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj" />
+    <ProjectReference Include="..\OptimAI.BRE.RuleEngine\OptimAI.BRE.RuleEngine.csproj" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.RuleEngine.csproj

@@ -0,0 +1,21 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.RuleEngine</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.1" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Relational" Version="8.0.1" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.2" />
+    <PackageReference Include="EFCore.NamingConventions" Version="8.0.3" />
+    <PackageReference Include="Microsoft.Extensions.Caching.StackExchangeRedis" Version="8.0.1" />
+    <PackageReference Include="StackExchange.Redis" Version="2.7.17" />
+    <PackageReference Include="Microsoft.AspNetCore.Http.Abstractions" Version="2.2.0" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.Shared.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <RootNamespace>OptimAI.BRE.Shared</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.1" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Abstractions" Version="8.0.1" />
+  </ItemGroup>
+</Project>

OptimAI.BRE.sln

@@ -0,0 +1,35 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.8.0.0
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.Gateway", "OptimAI.BRE.Gateway\OptimAI.BRE.Gateway.csproj", "{A1B2C3D4-0001-0001-0001-000000000001}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.Shared", "OptimAI.BRE.Shared\OptimAI.BRE.Shared.csproj", "{A1B2C3D4-0002-0002-0002-000000000002}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.RuleEngine", "OptimAI.BRE.RuleEngine\OptimAI.BRE.RuleEngine.csproj", "{A1B2C3D4-0003-0003-0003-000000000003}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.RuleDesigner", "OptimAI.BRE.RuleDesigner\OptimAI.BRE.RuleDesigner.csproj", "{A1B2C3D4-0004-0004-0004-000000000004}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.AIEngine", "OptimAI.BRE.AIEngine\OptimAI.BRE.AIEngine.csproj", "{A1B2C3D4-0005-0005-0005-000000000005}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.IdentityService", "OptimAI.BRE.IdentityService\OptimAI.BRE.IdentityService.csproj", "{A1B2C3D4-0006-0006-0006-000000000006}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.ClientMgmt", "OptimAI.BRE.ClientMgmt\OptimAI.BRE.ClientMgmt.csproj", "{A1B2C3D4-0007-0007-0007-000000000007}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.AuditService", "OptimAI.BRE.AuditService\OptimAI.BRE.AuditService.csproj", "{A1B2C3D4-0008-0008-0008-000000000008}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "OptimAI.BRE.ReportService", "OptimAI.BRE.ReportService\OptimAI.BRE.ReportService.csproj", "{A1B2C3D4-0009-0009-0009-000000000009}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{A1B2C3D4-0001-0001-0001-000000000001}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{A1B2C3D4-0001-0001-0001-000000000001}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{A1B2C3D4-0001-0001-0001-000000000001}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{A1B2C3D4-0001-0001-0001-000000000001}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+EndGlobal

Program.cs

@@ -0,0 +1,275 @@
+using System.Text;
+using System.Threading.RateLimiting;
+using Azure.AI.OpenAI;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.IdentityModel.Tokens;
+using Microsoft.OpenApi.Models;
+using OptimAI.BRE.AIEngine.Application;
+using OptimAI.BRE.RuleEngine.Api;
+using OptimAI.BRE.RuleEngine.Application;
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.RuleEngine.Infrastructure;
+using Serilog;
+using StackExchange.Redis;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// ============================================================
+// LOGGING - Serilog
+// ============================================================
+builder.Host.UseSerilog((ctx, lc) => lc
+    .ReadFrom.Configuration(ctx.Configuration)
+    .Enrich.FromLogContext()
+    .Enrich.WithProperty("Application", "OptimAI.BRE")
+    .WriteTo.Console(outputTemplate: "[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj} {Properties:j}{NewLine}{Exception}")
+    .WriteTo.File("logs/optim-ai-bre-.log", rollingInterval: RollingInterval.Day));
+
+// ============================================================
+// DATABASE
+// ============================================================
+builder.Services.AddDbContext<BREDbContext>(opts =>
+    opts.UseNpgsql(
+        builder.Configuration.GetConnectionString("PostgreSQL"),
+        npg => npg.EnableRetryOnFailure(3)
+    )
+    .UseSnakeCaseNamingConvention()
+);
+
+// ============================================================
+// REDIS CACHE
+// ============================================================
+builder.Services.AddSingleton<IConnectionMultiplexer>(_ =>
+    ConnectionMultiplexer.Connect(builder.Configuration.GetConnectionString("Redis")!));
+
+builder.Services.AddStackExchangeRedisCache(opts =>
+    opts.Configuration = builder.Configuration.GetConnectionString("Redis"));
+
+// ============================================================
+// AUTHENTICATION & AUTHORIZATION
+// ============================================================
+var jwtSettings = builder.Configuration.GetSection("Jwt");
+builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(opts =>
+    {
+        opts.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidateAudience = true,
+            ValidateLifetime = true,
+            ValidateIssuerSigningKey = true,
+            ValidIssuer = jwtSettings["Issuer"],
+            ValidAudience = jwtSettings["Audience"],
+            IssuerSigningKey = new SymmetricSecurityKey(
+                Encoding.UTF8.GetBytes(jwtSettings["SecretKey"]!)),
+            ClockSkew = TimeSpan.FromMinutes(1)
+        };
+
+        opts.Events = new JwtBearerEvents
+        {
+            OnAuthenticationFailed = ctx =>
+            {
+                Log.Warning("JWT auth failed: {Error}", ctx.Exception.Message);
+                return Task.CompletedTask;
+            }
+        };
+    });
+
+builder.Services.AddAuthorizationBuilder()
+    .AddPolicy("RuleWrite", p => p.RequireClaim("permission", "RULE.CREATE", "RULE.EDIT"))
+    .AddPolicy("RuleApprove", p => p.RequireClaim("permission", "RULE.APPROVE"))
+    .AddPolicy("RulePublish", p => p.RequireClaim("permission", "RULE.PUBLISH"))
+    .AddPolicy("SandboxAccess", p => p.RequireClaim("permission", "EXECUTION.SANDBOX"))
+    .AddPolicy("AiGenerate", p => p.RequireClaim("permission", "AI.GENERATE"))
+    .AddPolicy("AiAnalysis", p => p.RequireClaim("permission", "AI.ANALYSIS"))
+    .AddPolicy("AdminOnly", p => p.RequireClaim("permission", "ADMIN.FULL"));
+
+// ============================================================
+// RATE LIMITING
+// ============================================================
+builder.Services.AddRateLimiter(opts =>
+{
+    opts.AddTokenBucketLimiter("bre-execution", cfg =>
+    {
+        cfg.TokenLimit = 1000;
+        cfg.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
+        cfg.QueueLimit = 100;
+        cfg.ReplenishmentPeriod = TimeSpan.FromMinutes(1);
+        cfg.TokensPerPeriod = 1000;
+        cfg.AutoReplenishment = true;
+    });
+
+    opts.AddFixedWindowLimiter("api-standard", cfg =>
+    {
+        cfg.PermitLimit = 500;
+        cfg.Window = TimeSpan.FromMinutes(1);
+    });
+
+    opts.OnRejected = async (ctx, ct) =>
+    {
+        ctx.HttpContext.Response.StatusCode = 429;
+        await ctx.HttpContext.Response.WriteAsJsonAsync(new
+        {
+            error = "Rate limit exceeded",
+            retryAfter = ctx.Lease.TryGetMetadata(MetadataName.RetryAfter, out var retry) ? retry.TotalSeconds : 60
+        }, ct);
+    };
+});
+
+// ============================================================
+// HEALTH CHECKS
+// ============================================================
+builder.Services.AddHealthChecks()
+    .AddNpgSql(builder.Configuration.GetConnectionString("PostgreSQL")!, name: "postgresql")
+    .AddRedis(builder.Configuration.GetConnectionString("Redis")!, name: "redis");
+
+// ============================================================
+// OPENAI / AZURE OPENAI
+// ============================================================
+builder.Services.Configure<AiOptions>(builder.Configuration.GetSection("AiOptions"));
+builder.Services.AddSingleton<OpenAIClient>(_ =>
+{
+    var aiConfig = builder.Configuration.GetSection("AiOptions");
+    return aiConfig.GetValue<bool>("UseAzureOpenAI")
+        ? new OpenAIClient(new Uri(aiConfig["Endpoint"]!), new Azure.AzureKeyCredential(aiConfig["ApiKey"]!))
+        : new OpenAIClient(aiConfig["ApiKey"]);
+});
+
+// ============================================================
+// BRE SERVICES
+// ============================================================
+builder.Services.AddScoped<IRuleExecutionService, RuleExecutionService>();
+builder.Services.AddScoped<IConditionEvaluator, ConditionEvaluator>();
+builder.Services.AddScoped<IActionExecutor, ActionExecutor>();
+builder.Services.AddScoped<IRiskScoringEngine, RiskScoringEngine>();
+builder.Services.AddScoped<IDynamicFieldResolver, DynamicFieldResolver>();
+builder.Services.AddScoped<IRuleLoader, CachedRuleLoader>();
+builder.Services.AddScoped<IAiCreditAnalystService, AiCreditAnalystService>();
+builder.Services.AddScoped<ITenantContextAccessor, TenantContextAccessor>();
+
+// Infrastructure repositories
+builder.Services.AddScoped<IDeviationTypeRepository, DeviationTypeRepository>();
+builder.Services.AddScoped<IRiskWeightRepository, RiskWeightRepository>();
+builder.Services.AddScoped<IExecutionRequestRepository, ExecutionRequestRepository>();
+builder.Services.AddScoped<IExecutionResultRepository, ExecutionResultRepository>();
+builder.Services.AddScoped<IDecisionReportService, DecisionReportService>();
+builder.Services.AddScoped<ISandboxService, SandboxService>();
+builder.Services.AddScoped<IAiPromptRepository, AiPromptRepository>();
+builder.Services.AddScoped<IAiRuleGeneratorRepository, AiRuleGeneratorRepository>();
+builder.Services.AddScoped<IFieldCatalogRepository, FieldCatalogRepository>();
+builder.Services.AddScoped<IRuleRepository, RuleRepository>();
+builder.Services.AddScoped<IRuleVersionRepository, RuleVersionRepository>();
+builder.Services.AddScoped<IRuleApprovalService, RuleApprovalService>();
+builder.Services.AddScoped<IAuditService, AuditService>();
+
+// ============================================================
+// API & SWAGGER
+// ============================================================
+builder.Services.AddControllers()
+    .AddJsonOptions(opts =>
+    {
+        opts.JsonSerializerOptions.PropertyNamingPolicy = System.Text.Json.JsonNamingPolicy.CamelCase;
+        opts.JsonSerializerOptions.Converters.Add(new System.Text.Json.Serialization.JsonStringEnumConverter());
+    });
+
+builder.Services.AddEndpointsApiExplorer();
+builder.Services.AddSwaggerGen(c =>
+{
+    c.SwaggerDoc("v1", new OpenApiInfo
+    {
+        Title = "OPTIM AI BRE Engine API",
+        Version = "v1",
+        Description = "Enterprise AI-Powered Business Rule Engine for Banks, NBFCs, and Lending Institutions",
+        Contact = new OpenApiContact
+        {
+            Name = "OPTIM AI Support",
+            Email = "support@optimai.in"
+        }
+    });
+
+    c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
+    {
+        Type = SecuritySchemeType.Http,
+        Scheme = "bearer",
+        BearerFormat = "JWT",
+        Description = "Enter JWT token"
+    });
+
+    c.AddSecurityDefinition("ApiKey", new OpenApiSecurityScheme
+    {
+        Type = SecuritySchemeType.ApiKey,
+        In = ParameterLocation.Header,
+        Name = "X-API-Key",
+        Description = "API Key authentication"
+    });
+
+    c.AddSecurityRequirement(new OpenApiSecurityRequirement
+    {
+        {
+            new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "Bearer" } },
+            Array.Empty<string>()
+        }
+    });
+
+    var xmlFile = $"{System.Reflection.Assembly.GetExecutingAssembly().GetName().Name}.xml";
+    var xmlPath = Path.Combine(AppContext.BaseDirectory, xmlFile);
+    if (File.Exists(xmlPath)) c.IncludeXmlComments(xmlPath);
+});
+
+// CORS
+builder.Services.AddCors(opts =>
+    opts.AddPolicy("AllowFrontend", p => p
+        .WithOrigins(builder.Configuration.GetSection("AllowedOrigins").Get<string[]>() ?? new[] { "*" })
+        .AllowAnyMethod()
+        .AllowAnyHeader()
+        .AllowCredentials()));
+
+// ============================================================
+// BUILD APP
+// ============================================================
+var app = builder.Build();
+
+app.UseSerilogRequestLogging(opts =>
+{
+    opts.EnrichDiagnosticContext = (diag, ctx) =>
+    {
+        diag.Set("TenantId", ctx.Request.Headers["X-Tenant-ID"].FirstOrDefault() ?? "");
+        diag.Set("RequestId", ctx.TraceIdentifier);
+    };
+});
+
+if (app.Environment.IsDevelopment() || app.Environment.IsStaging())
+{
+    app.UseSwagger();
+    app.UseSwaggerUI(c =>
+    {
+        c.SwaggerEndpoint("/swagger/v1/swagger.json", "OPTIM AI BRE v1");
+        c.RoutePrefix = "swagger";
+        c.DocExpansion(Swashbuckle.AspNetCore.SwaggerUI.DocExpansion.None);
+    });
+}
+
+app.UseHttpsRedirection();
+app.UseCors("AllowFrontend");
+app.UseRateLimiter();
+
+// Tenant resolution middleware
+app.UseMiddleware<TenantResolutionMiddleware>();
+app.UseMiddleware<ApiKeyMiddleware>();
+
+app.UseAuthentication();
+app.UseAuthorization();
+
+app.MapControllers();
+app.MapHealthChecks("/health");
+app.MapHealthChecks("/health/ready");
+
+// Auto-migrate on startup
+using (var scope = app.Services.CreateScope())
+{
+    var db = scope.ServiceProvider.GetRequiredService<BREDbContext>();
+    await db.Database.MigrateAsync();
+}
+
+await app.RunAsync();

RepositoryStubs.cs

@@ -0,0 +1,480 @@
+// ============================================================
+// REPOSITORY STUB IMPLEMENTATIONS
+// These are functional local-dev implementations.
+// Replace with full implementations per module.
+// ============================================================
+
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Caching.Distributed;
+using OptimAI.BRE.AIEngine.Api;
+using OptimAI.BRE.RuleDesigner.Api;
+using OptimAI.BRE.RuleEngine.Api;
+using OptimAI.BRE.RuleEngine.Application;
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.Shared.Domain;
+using System.Text.Json;
+
+namespace OptimAI.BRE.RuleEngine.Infrastructure;
+
+// ---- DynamicFieldResolver ----
+public class DynamicFieldResolver : IDynamicFieldResolver
+{
+    public object? Resolve(string fieldPath, DynamicDataContext context) => context.GetValue(fieldPath);
+
+    public bool TryResolve(string fieldPath, DynamicDataContext context, out object? value)
+    {
+        value = context.GetValue(fieldPath);
+        return true;
+    }
+}
+
+// ---- DeviationTypeRepository ----
+public class DeviationTypeRepository : IDeviationTypeRepository
+{
+    private readonly BREDbContext _db;
+    public DeviationTypeRepository(BREDbContext db) => _db = db;
+
+    public async Task<DeviationType?> FindByCodeAsync(Guid tenantId, string code, CancellationToken ct = default)
+        => await _db.DeviationTypes.FirstOrDefaultAsync(d =>
+            (d.TenantId == tenantId || d.TenantId == null) && d.DeviationCode == code, ct);
+
+    public async Task<IReadOnlyList<DeviationType>> GetAllActiveAsync(Guid tenantId, CancellationToken ct = default)
+        => await _db.DeviationTypes
+            .Where(d => (d.TenantId == tenantId || d.TenantId == null) && d.IsActive)
+            .ToListAsync(ct);
+}
+
+// ---- RiskWeightRepository ----
+public class RiskWeightRepository : IRiskWeightRepository
+{
+    public Task<Dictionary<string, decimal>> GetWeightsAsync(Guid tenantId, string? productCode = null)
+        => Task.FromResult(new Dictionary<string, decimal>
+        {
+            ["bureau"] = 30, ["income"] = 25, ["fi"] = 15,
+            ["fraud"] = 15, ["vehicle"] = 10, ["employment"] = 10, ["rule_penalty"] = 5
+        });
+}
+
+// ---- ExecutionRequestRepository ----
+public class ExecutionRequestRepository : IExecutionRequestRepository
+{
+    private readonly BREDbContext _db;
+    public ExecutionRequestRepository(BREDbContext db) => _db = db;
+
+    public async Task<ExecutionRequest> CreateAsync(ExecutionRequest request, CancellationToken ct = default)
+    {
+        _db.ExecutionRequests.Add(request);
+        await _db.SaveChangesAsync(ct);
+        return request;
+    }
+
+    public async Task MarkCompletedAsync(Guid id, CancellationToken ct = default)
+    {
+        await _db.ExecutionRequests.Where(r => r.Id == id)
+            .ExecuteUpdateAsync(s => s
+                .SetProperty(r => r.Status, ExecutionStatus.Completed)
+                .SetProperty(r => r.CompletedAt, DateTime.UtcNow), ct);
+    }
+}
+
+// ---- ExecutionResultRepository ----
+public class ExecutionResultRepository : IExecutionResultRepository
+{
+    private readonly BREDbContext _db;
+    public ExecutionResultRepository(BREDbContext db) => _db = db;
+
+    public async Task SaveAsync(ExecutionResult result, CancellationToken ct = default)
+    {
+        _db.ExecutionResults.Add(result);
+        await _db.SaveChangesAsync(ct);
+    }
+
+    public async Task<ExecutionResult?> GetByRequestIdAsync(Guid requestId, Guid tenantId, CancellationToken ct = default)
+        => await _db.ExecutionResults.FirstOrDefaultAsync(r => r.RequestId == requestId && r.TenantId == tenantId, ct);
+
+    public async Task<PagedResponse<DecisionSummaryDto>> GetHistoryAsync(DecisionHistoryQuery query, CancellationToken ct = default)
+    {
+        var q = _db.ExecutionResults
+            .Join(_db.ExecutionRequests, r => r.RequestId, req => req.Id, (r, req) => new { r, req })
+            .Where(x => x.r.TenantId == query.TenantId);
+
+        if (query.Decision != null) q = q.Where(x => x.r.FinalDecision.ToString() == query.Decision);
+        if (query.FromDate.HasValue) q = q.Where(x => x.req.CreatedAt >= query.FromDate);
+        if (query.ToDate.HasValue) q = q.Where(x => x.req.CreatedAt <= query.ToDate);
+
+        var total = await q.CountAsync(ct);
+        var items = await q.OrderByDescending(x => x.req.CreatedAt)
+            .Skip((query.Page - 1) * query.PageSize)
+            .Take(query.PageSize)
+            .Select(x => new DecisionSummaryDto
+            {
+                RequestId = x.r.RequestId,
+                ApplicationId = x.req.ApplicationId,
+                Decision = x.r.FinalDecision.ToString(),
+                TrafficLight = x.r.TrafficLight.ToString() ?? "AMBER",
+                RiskScore = x.r.RiskScore ?? 0,
+                DeviationsCount = x.r.DeviationsCount,
+                CreatedAt = x.req.CreatedAt
+            })
+            .ToListAsync(ct);
+
+        return new PagedResponse<DecisionSummaryDto>
+        {
+            Items = items, TotalCount = total,
+            Page = query.Page, PageSize = query.PageSize
+        };
+    }
+}
+
+// ---- DecisionReportService ----
+public class DecisionReportService : IDecisionReportService
+{
+    private readonly BREDbContext _db;
+    public DecisionReportService(BREDbContext db) => _db = db;
+
+    public async Task<DecisionReport?> GenerateAsync(Guid requestId, ExecutionResult result, CancellationToken ct = default)
+    {
+        var report = new DecisionReportEntity
+        {
+            RequestId = requestId,
+            TenantId = result.TenantId,
+            FinalDecision = result.FinalDecision.ToString(),
+            RiskScore = result.RiskScore,
+            RiskCategory = result.RiskCategory?.ToString(),
+            TrafficLight = result.TrafficLight?.ToString(),
+            ReportJson = JsonSerializer.Serialize(result),
+            GeneratedAt = DateTime.UtcNow
+        };
+        _db.DecisionReports.Add(report);
+        await _db.SaveChangesAsync(ct);
+        return new DecisionReport { Id = report.Id };
+    }
+}
+
+// ---- SandboxService ----
+public class SandboxService : ISandboxService
+{
+    private readonly IRuleExecutionService _exec;
+    private readonly IRuleLoader _loader;
+    public SandboxService(IRuleExecutionService exec, IRuleLoader loader)
+    {
+        _exec = exec;
+        _loader = loader;
+    }
+
+    public async Task<object> SimulateAsync(SandboxRequest request, CancellationToken ct = default)
+    {
+        var context = new ExecutionContext
+        {
+            TenantId = request.TenantId,
+            CorrelationId = $"sandbox-{Guid.NewGuid()}",
+            RuleSetId = request.RuleSetId,
+            Data = new DynamicDataContext(request.TestData),
+            Options = new ExecutionOptions { EnableAiAnalysis = false }
+        };
+        return await _exec.ExecuteAsync(context, ct);
+    }
+}
+
+// ---- AiPromptRepository ----
+public class AiPromptRepository : IAiPromptRepository
+{
+    private readonly BREDbContext _db;
+    public AiPromptRepository(BREDbContext db) => _db = db;
+
+    public async Task<string?> GetPromptAsync(string promptCode, CancellationToken ct = default)
+    {
+        var p = await _db.Set<AiPromptEntity>()
+            .FirstOrDefaultAsync(x => x.PromptCode == promptCode && x.IsActive, ct);
+        return p?.PromptTemplate;
+    }
+}
+
+// ---- AiRuleGeneratorRepository ----
+public class AiRuleGeneratorRepository : IAiRuleGeneratorRepository
+{
+    private readonly BREDbContext _db;
+    public AiRuleGeneratorRepository(BREDbContext db) => _db = db;
+
+    public async Task<Guid> SaveGeneratedRuleAsync(AiGeneratedRuleRecord record, CancellationToken ct = default)
+    {
+        var entity = new AiGeneratedRuleEntity
+        {
+            TenantId = record.TenantId,
+            UserPrompt = record.UserPrompt,
+            GeneratedRule = JsonSerializer.Serialize(record.GeneratedRule),
+            CreatedBy = record.CreatedBy
+        };
+        _db.AiGeneratedRules.Add(entity);
+        await _db.SaveChangesAsync(ct);
+        return entity.Id;
+    }
+
+    public async Task<bool> AcceptRuleAsync(Guid generationId, Guid tenantId, Guid? categoryId, Guid userId, CancellationToken ct = default)
+    {
+        var entity = await _db.AiGeneratedRules
+            .FirstOrDefaultAsync(e => e.Id == generationId && e.TenantId == tenantId, ct);
+        if (entity == null) return false;
+        entity.IsAccepted = true;
+        await _db.SaveChangesAsync(ct);
+        return true;
+    }
+
+    public async Task<List<AiGeneratedRuleRecord>> GetHistoryAsync(Guid tenantId, int page, int pageSize, CancellationToken ct = default)
+    {
+        return await _db.AiGeneratedRules
+            .Where(e => e.TenantId == tenantId)
+            .OrderByDescending(e => e.CreatedAt)
+            .Skip((page - 1) * pageSize).Take(pageSize)
+            .Select(e => new AiGeneratedRuleRecord
+            {
+                Id = e.Id, TenantId = e.TenantId, UserPrompt = e.UserPrompt,
+                IsAccepted = e.IsAccepted, CreatedBy = e.CreatedBy, CreatedAt = e.CreatedAt
+            })
+            .ToListAsync(ct);
+    }
+}
+
+// ---- FieldCatalogRepository ----
+public class FieldCatalogRepository : IFieldCatalogRepository
+{
+    private readonly BREDbContext _db;
+    public FieldCatalogRepository(BREDbContext db) => _db = db;
+
+    public async Task<List<string>> GetFieldPathsAsync(Guid tenantId, CancellationToken ct = default)
+        => await _db.FieldCatalog
+            .Where(f => f.IsActive && (f.TenantId == null || f.TenantId == tenantId))
+            .Select(f => f.FieldPath).ToListAsync(ct);
+
+    public async Task<List<FieldCatalogDto>> GetCatalogAsync(Guid tenantId, string? category = null, CancellationToken ct = default)
+    {
+        var q = _db.FieldCatalog.Where(f => f.IsActive && (f.TenantId == null || f.TenantId == tenantId));
+        if (category != null) q = q.Where(f => f.Category == category);
+        return await q.Select(f => new FieldCatalogDto
+        {
+            FieldPath = f.FieldPath, DisplayName = f.DisplayName,
+            DataType = f.DataType, Category = f.Category, Description = f.Description
+        }).ToListAsync(ct);
+    }
+}
+
+// ---- RuleRepository ----
+public class RuleRepository : IRuleRepository
+{
+    private readonly BREDbContext _db;
+    public RuleRepository(BREDbContext db) => _db = db;
+
+    public async Task<PagedResponse<RuleSummaryDto>> GetPagedAsync(RuleQuery query, CancellationToken ct = default)
+    {
+        var q = _db.Rules.Where(r => r.TenantId == query.TenantId).IgnoreQueryFilters();
+        if (query.Status != null && Enum.TryParse<RuleStatus>(query.Status, true, out var s))
+            q = q.Where(r => r.Status == s);
+        if (query.RuleType != null && Enum.TryParse<RuleType>(query.RuleType, true, out var rt))
+            q = q.Where(r => r.RuleType == rt);
+        if (!string.IsNullOrWhiteSpace(query.Search))
+            q = q.Where(r => r.RuleName.Contains(query.Search) || r.RuleCode.Contains(query.Search));
+
+        var total = await q.CountAsync(ct);
+        var items = await q.OrderBy(r => r.Priority).ThenBy(r => r.RuleName)
+            .Skip((query.Page - 1) * query.PageSize).Take(query.PageSize)
+            .Select(r => new RuleSummaryDto
+            {
+                Id = r.Id, RuleCode = r.RuleCode, RuleName = r.RuleName,
+                RuleType = r.RuleType.ToString(), Status = r.Status.ToString(),
+                IsActive = r.IsActive, IsPublished = r.IsPublished,
+                Priority = r.Priority, Tags = r.Tags,
+                CreatedAt = r.CreatedAt, UpdatedAt = r.UpdatedAt
+            }).ToListAsync(ct);
+
+        return new PagedResponse<RuleSummaryDto>
+        { Items = items, TotalCount = total, Page = query.Page, PageSize = query.PageSize };
+    }
+
+    public async Task<Rule?> GetByIdAsync(Guid id, Guid tenantId, CancellationToken ct = default)
+        => await _db.Rules.IgnoreQueryFilters()
+            .Include(r => r.CurrentVersion)
+            .Include(r => r.Scopes)
+            .Include(r => r.Category)
+            .FirstOrDefaultAsync(r => r.Id == id && r.TenantId == tenantId, ct);
+
+    public async Task<Rule> CreateWithVersionAsync(Rule rule, RuleVersion version, CancellationToken ct = default)
+    {
+        _db.Rules.Add(rule);
+        await _db.SaveChangesAsync(ct);
+        version.RuleId = rule.Id;
+        version.TenantId = rule.TenantId;
+        _db.RuleVersions.Add(version);
+        await _db.SaveChangesAsync(ct);
+        rule.CurrentVersionId = version.Id;
+        await _db.SaveChangesAsync(ct);
+        return rule;
+    }
+
+    public async Task UpdateWithNewVersionAsync(Rule rule, RuleVersion newVersion, CancellationToken ct = default)
+    {
+        _db.Rules.Update(rule);
+        _db.RuleVersions.Add(newVersion);
+        await _db.SaveChangesAsync(ct);
+    }
+
+    public async Task PublishAsync(Guid id, Guid tenantId, Guid publishedBy, CancellationToken ct = default)
+    {
+        var rule = await _db.Rules.IgnoreQueryFilters().Include(r => r.CurrentVersion)
+            .FirstOrDefaultAsync(r => r.Id == id && r.TenantId == tenantId, ct);
+        if (rule == null) return;
+        rule.IsPublished = true;
+        rule.IsDraft = false;
+        rule.Status = RuleStatus.Published;
+        if (rule.CurrentVersion != null)
+        {
+            rule.CurrentVersion.Status = RuleStatus.Published;
+            rule.CurrentVersion.PublishedBy = publishedBy;
+            rule.CurrentVersion.PublishedAt = DateTime.UtcNow;
+        }
+        await _db.SaveChangesAsync(ct);
+    }
+
+    public async Task<Rule> CloneAsync(Guid id, Guid tenantId, Guid clonedBy, string? newCode, string? newName, CancellationToken ct = default)
+    {
+        var original = await GetByIdAsync(id, tenantId, ct);
+        var clone = new Rule
+        {
+            TenantId = tenantId,
+            RuleCode = newCode ?? $"{original!.RuleCode}_copy_{DateTime.UtcNow.Ticks}",
+            RuleName = newName ?? $"{original.RuleName} (Copy)",
+            Description = original.Description,
+            CategoryId = original.CategoryId,
+            RuleType = original.RuleType,
+            Priority = original.Priority,
+            Tags = new List<string>(original.Tags),
+            Status = RuleStatus.Draft,
+            CreatedBy = clonedBy
+        };
+        var version = new RuleVersion
+        {
+            TenantId = tenantId,
+            VersionNumber = 1,
+            VersionLabel = "v1.0",
+            RuleDefinition = original!.CurrentVersion!.RuleDefinition,
+            ChangeSummary = $"Cloned from {original.RuleCode}",
+            IsCurrent = true,
+            Status = RuleStatus.Draft,
+            CreatedBy = clonedBy
+        };
+        return await CreateWithVersionAsync(clone, version, ct);
+    }
+
+    public async Task ToggleActiveAsync(Guid id, Guid tenantId, CancellationToken ct = default)
+    {
+        var rule = await _db.Rules.IgnoreQueryFilters()
+            .FirstOrDefaultAsync(r => r.Id == id && r.TenantId == tenantId, ct);
+        if (rule == null) return;
+        rule.IsActive = !rule.IsActive;
+        await _db.SaveChangesAsync(ct);
+    }
+
+    public async Task UpdateScopesAsync(Guid id, Guid tenantId, List<RuleScopeRequest> scopes, CancellationToken ct = default)
+    {
+        var existing = _db.RuleScopes.Where(s => s.RuleId == id);
+        _db.RuleScopes.RemoveRange(existing);
+        foreach (var s in scopes)
+        {
+            _db.RuleScopes.Add(new RuleScope
+            {
+                RuleId = id, TenantId = tenantId,
+                ScopeType = Enum.Parse<ScopeType>(s.ScopeType, true),
+                ScopeValue = s.ScopeValue, IsExcluded = s.IsExcluded
+            });
+        }
+        await _db.SaveChangesAsync(ct);
+    }
+}
+
+// ---- RuleVersionRepository ----
+public class RuleVersionRepository : IRuleVersionRepository
+{
+    private readonly BREDbContext _db;
+    public RuleVersionRepository(BREDbContext db) => _db = db;
+
+    public async Task<RuleVersion?> GetLatestAsync(Guid ruleId, CancellationToken ct = default)
+        => await _db.RuleVersions.Where(v => v.RuleId == ruleId)
+            .OrderByDescending(v => v.VersionNumber).FirstOrDefaultAsync(ct);
+
+    public async Task<List<RuleVersion>> GetAllAsync(Guid ruleId, Guid tenantId, CancellationToken ct = default)
+        => await _db.RuleVersions
+            .Where(v => v.RuleId == ruleId && v.TenantId == tenantId)
+            .OrderByDescending(v => v.VersionNumber).ToListAsync(ct);
+}
+
+// ---- RuleApprovalService ----
+public class RuleApprovalService : IRuleApprovalService
+{
+    private readonly BREDbContext _db;
+    public RuleApprovalService(BREDbContext db) => _db = db;
+
+    public async Task SubmitForApprovalAsync(Guid ruleId, Guid versionId, Guid tenantId, Guid requestedBy, string? comments, CancellationToken ct = default)
+    {
+        await _db.Rules.IgnoreQueryFilters().Where(r => r.Id == ruleId)
+            .ExecuteUpdateAsync(s => s.SetProperty(r => r.Status, RuleStatus.PendingApproval), ct);
+        _db.RuleApprovals.Add(new RuleApproval
+        {
+            RuleId = ruleId, VersionId = versionId, TenantId = tenantId,
+            RequestedBy = requestedBy, Comments = comments, Status = "PENDING"
+        });
+        await _db.SaveChangesAsync(ct);
+    }
+
+    public async Task ApproveAsync(Guid ruleId, Guid tenantId, Guid approvedBy, string? comments, CancellationToken ct = default)
+    {
+        await _db.Rules.IgnoreQueryFilters().Where(r => r.Id == ruleId)
+            .ExecuteUpdateAsync(s => s.SetProperty(r => r.Status, RuleStatus.Approved), ct);
+        var approval = await _db.RuleApprovals.OrderByDescending(a => a.RequestedAt)
+            .FirstOrDefaultAsync(a => a.RuleId == ruleId && a.Status == "PENDING", ct);
+        if (approval != null)
+        {
+            approval.Status = "APPROVED";
+            approval.ReviewedBy = approvedBy;
+            approval.ReviewedAt = DateTime.UtcNow;
+            approval.Comments = comments;
+            await _db.SaveChangesAsync(ct);
+        }
+    }
+
+    public async Task RejectAsync(Guid ruleId, Guid tenantId, Guid rejectedBy, string comments, CancellationToken ct = default)
+    {
+        await _db.Rules.IgnoreQueryFilters().Where(r => r.Id == ruleId)
+            .ExecuteUpdateAsync(s => s.SetProperty(r => r.Status, RuleStatus.Draft), ct);
+        var approval = await _db.RuleApprovals.OrderByDescending(a => a.RequestedAt)
+            .FirstOrDefaultAsync(a => a.RuleId == ruleId && a.Status == "PENDING", ct);
+        if (approval != null)
+        {
+            approval.Status = "REJECTED";
+            approval.ReviewedBy = rejectedBy;
+            approval.ReviewedAt = DateTime.UtcNow;
+            approval.Comments = comments;
+            await _db.SaveChangesAsync(ct);
+        }
+    }
+}
+
+// ---- AuditService ----
+public class AuditService : IAuditService
+{
+    private readonly BREDbContext _db;
+    public AuditService(BREDbContext db) => _db = db;
+
+    public async Task LogAsync(AuditLog log, CancellationToken ct = default)
+    {
+        _db.AuditLogs.Add(log);
+        await _db.SaveChangesAsync(ct);
+    }
+}
+
+// Placeholder entity for AI prompts (extend BREDbContext if needed)
+public class AiPromptEntity
+{
+    public Guid Id { get; set; }
+    public string PromptCode { get; set; } = default!;
+    public string PromptTemplate { get; set; } = default!;
+    public bool IsActive { get; set; } = true;
+}

RiskScoringEngine.cs

@@ -0,0 +1,285 @@
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.Shared.Domain;
+
+namespace OptimAI.BRE.RuleEngine.Application;
+
+/// <summary>
+/// Multi-dimensional risk scoring engine.
+/// Computes weighted risk score from 0–100 across bureau, income, FI, fraud, and vehicle dimensions.
+/// </summary>
+public sealed class RiskScoringEngine : IRiskScoringEngine
+{
+    private readonly IRiskWeightRepository _weightRepository;
+
+    public RiskScoringEngine(IRiskWeightRepository weightRepository)
+    {
+        _weightRepository = weightRepository;
+    }
+
+    public async Task<RiskScoreResult> CalculateAsync(ExecutionContext context, List<RuleEvaluationResult> results)
+    {
+        var weights = await _weightRepository.GetWeightsAsync(context.TenantId, context.ProductCode);
+        var data = context.Data;
+        var componentScores = new Dictionary<string, decimal>();
+
+        // ---- 1. Bureau Score Component (0–100, inverted for risk)
+        componentScores["bureau"] = CalculateBureauScore(data, weights);
+
+        // ---- 2. Income / FOIR Component
+        componentScores["income"] = CalculateIncomeScore(data, weights);
+
+        // ---- 3. FI Component
+        componentScores["fi"] = CalculateFiScore(data, weights);
+
+        // ---- 4. Fraud Component
+        componentScores["fraud"] = CalculateFraudScore(data, weights);
+
+        // ---- 5. Vehicle Component (for vehicle loans)
+        componentScores["vehicle"] = CalculateVehicleScore(data, weights);
+
+        // ---- 6. Employment Component
+        componentScores["employment"] = CalculateEmploymentScore(data, weights);
+
+        // ---- 7. Rule Match Penalty
+        componentScores["rule_penalty"] = CalculateRulePenalty(results);
+
+        // Weighted aggregate
+        decimal totalWeight = weights.Sum(w => w.Value);
+        decimal weightedScore = componentScores.Sum(cs =>
+        {
+            var weight = weights.GetValueOrDefault(cs.Key, GetDefaultWeight(cs.Key));
+            return cs.Value * weight;
+        });
+
+        decimal finalScore = totalWeight > 0
+            ? Math.Round(weightedScore / totalWeight, 2)
+            : Math.Round(componentScores.Values.Average(), 2);
+
+        finalScore = Math.Clamp(finalScore, 0, 100);
+
+        return new RiskScoreResult
+        {
+            Score = finalScore,
+            Category = ClassifyRisk(finalScore),
+            TrafficLight = ScoreToTrafficLight(finalScore),
+            ComponentScores = componentScores
+        };
+    }
+
+    private static decimal CalculateBureauScore(DynamicDataContext data, Dictionary<string, decimal> weights)
+    {
+        var cibilScore = GetDecimal(data, "bureau.cibil_score");
+        var maxDpd = GetDecimal(data, "bureau.max_dpd_24m");
+        var writtenOff = GetBool(data, "bureau.written_off_amount");
+        var suitFiled = GetBool(data, "bureau.suit_filed");
+        var wilfulDefaulter = GetBool(data, "bureau.wilful_defaulter");
+
+        decimal score = 50m; // default medium
+
+        if (cibilScore.HasValue)
+        {
+            score = cibilScore.Value switch
+            {
+                >= 780 => 5,
+                >= 750 => 15,
+                >= 720 => 25,
+                >= 700 => 35,
+                >= 680 => 45,
+                >= 650 => 60,
+                >= 620 => 70,
+                >= 600 => 80,
+                _ => 90
+            };
+        }
+
+        // DPD penalty
+        if (maxDpd.HasValue)
+        {
+            score += maxDpd.Value switch
+            {
+                0 => 0,
+                <= 30 => 10,
+                <= 60 => 20,
+                <= 90 => 30,
+                _ => 40
+            };
+        }
+
+        // Critical flags
+        if (writtenOff) score = Math.Max(score, 85);
+        if (suitFiled) score = Math.Max(score, 90);
+        if (wilfulDefaulter) score = 100;
+
+        return Math.Clamp(score, 0, 100);
+    }
+
+    private static decimal CalculateIncomeScore(DynamicDataContext data, Dictionary<string, decimal> weights)
+    {
+        var foir = GetDecimal(data, "ratios.foir");
+        var income = GetDecimal(data, "employment.monthly_income");
+        var emiObligation = GetDecimal(data, "bureau.total_emi_obligation");
+
+        decimal score = 30m;
+
+        if (foir.HasValue)
+        {
+            score = foir.Value switch
+            {
+                <= 30 => 10,
+                <= 40 => 20,
+                <= 50 => 35,
+                <= 60 => 55,
+                <= 70 => 70,
+                <= 80 => 85,
+                _ => 95
+            };
+        }
+        else if (income.HasValue && emiObligation.HasValue && income.Value > 0)
+        {
+            var computedFoir = (emiObligation.Value / income.Value) * 100;
+            score = computedFoir <= 40 ? 15 : computedFoir <= 60 ? 45 : 75;
+        }
+
+        return Math.Clamp(score, 0, 100);
+    }
+
+    private static decimal CalculateFiScore(DynamicDataContext data, Dictionary<string, decimal> weights)
+    {
+        var fiNegative = GetBool(data, "fi.negative");
+        var addressMatch = GetBool(data, "fi.address_match");
+        var mobileMatch = GetBool(data, "fi.mobile_match");
+        var fiVerified = GetBool(data, "fi.verified");
+
+        if (!fiVerified) return 40m; // unverified
+
+        decimal score = 10m;
+        if (fiNegative) score += 60;
+        if (!addressMatch) score += 20;
+        if (!mobileMatch) score += 10;
+
+        return Math.Clamp(score, 0, 100);
+    }
+
+    private static decimal CalculateFraudScore(DynamicDataContext data, Dictionary<string, decimal> weights)
+    {
+        var fraudScore = GetDecimal(data, "fraud.score");
+        var blacklisted = GetBool(data, "fraud.blacklisted");
+
+        if (blacklisted) return 100;
+        return fraudScore.HasValue ? Math.Clamp(fraudScore.Value, 0, 100) : 20m;
+    }
+
+    private static decimal CalculateVehicleScore(DynamicDataContext data, Dictionary<string, decimal> weights)
+    {
+        var vehicleAge = GetDecimal(data, "vehicle.age_years");
+        var ltv = GetDecimal(data, "ratios.ltv");
+
+        decimal score = 20m;
+
+        if (vehicleAge.HasValue)
+        {
+            score += vehicleAge.Value switch
+            {
+                <= 2 => 0,
+                <= 5 => 10,
+                <= 8 => 20,
+                <= 10 => 35,
+                _ => 50
+            };
+        }
+
+        if (ltv.HasValue)
+        {
+            score += ltv.Value switch
+            {
+                <= 70 => 0,
+                <= 80 => 10,
+                <= 90 => 20,
+                _ => 35
+            };
+        }
+
+        return Math.Clamp(score, 0, 100);
+    }
+
+    private static decimal CalculateEmploymentScore(DynamicDataContext data, Dictionary<string, decimal> weights)
+    {
+        var vintage = GetDecimal(data, "employment.vintage_months");
+        var empType = data.GetValue("employment.type")?.ToString();
+
+        decimal score = 30m;
+
+        if (vintage.HasValue)
+        {
+            score = vintage.Value switch
+            {
+                >= 60 => 5,
+                >= 36 => 15,
+                >= 24 => 25,
+                >= 12 => 40,
+                >= 6 => 60,
+                _ => 75
+            };
+        }
+
+        // Salaried lower risk than self-employed
+        if (empType?.ToLower() == "salaried") score = Math.Max(score - 10, 0);
+
+        return Math.Clamp(score, 0, 100);
+    }
+
+    private static decimal CalculateRulePenalty(List<RuleEvaluationResult> results)
+    {
+        int matchedCount = results.Count(r => r.IsMatched);
+        int totalCount = results.Count;
+        if (totalCount == 0) return 0;
+
+        return Math.Round((decimal)matchedCount / totalCount * 100, 2);
+    }
+
+    private static RiskCategory ClassifyRisk(decimal score) => score switch
+    {
+        <= 25 => RiskCategory.Low,
+        <= 50 => RiskCategory.Medium,
+        <= 75 => RiskCategory.High,
+        _ => RiskCategory.Critical
+    };
+
+    private static TrafficLight ScoreToTrafficLight(decimal score) => score switch
+    {
+        <= 40 => TrafficLight.Green,
+        <= 65 => TrafficLight.Amber,
+        _ => TrafficLight.Red
+    };
+
+    private static decimal? GetDecimal(DynamicDataContext data, string path)
+    {
+        var val = data.GetValue(path);
+        if (val == null) return null;
+        if (decimal.TryParse(val.ToString(), out var d)) return d;
+        return null;
+    }
+
+    private static bool GetBool(DynamicDataContext data, string path)
+    {
+        var val = data.GetValue(path);
+        return val is true or "true" or 1;
+    }
+
+    private static decimal GetDefaultWeight(string component) => component switch
+    {
+        "bureau" => 30,
+        "income" => 25,
+        "fi" => 15,
+        "fraud" => 15,
+        "vehicle" => 10,
+        "employment" => 10,
+        "rule_penalty" => 5,
+        _ => 10
+    };
+}
+
+public interface IRiskWeightRepository
+{
+    Task<Dictionary<string, decimal>> GetWeightsAsync(Guid tenantId, string? productCode = null);
+}

RuleBuilder.tsx

@@ -0,0 +1,274 @@
+'use client'
+
+import React, { useState, useCallback } from 'react'
+import { v4 as uuidv4 } from 'uuid'
+import {
+  DndContext,
+  DragEndEvent,
+  closestCenter,
+  PointerSensor,
+  useSensor,
+  useSensors,
+} from '@dnd-kit/core'
+import { SortableContext, verticalListSortingStrategy } from '@dnd-kit/sortable'
+import type {
+  ConditionGroup,
+  ConditionNode,
+  RuleAction,
+  RuleDefinition,
+  LogicalOperator,
+  ComparisonOperator,
+  ActionType,
+  FieldCatalogEntry,
+} from '@/types'
+import { ConditionGroupEditor } from './ConditionGroupEditor'
+import { ActionEditor } from './ActionEditor'
+import { RulePreview } from './RulePreview'
+
+interface RuleBuilderProps {
+  initialDefinition?: RuleDefinition
+  fieldCatalog: FieldCatalogEntry[]
+  onChange: (definition: RuleDefinition) => void
+  readOnly?: boolean
+}
+
+const defaultConditionGroup = (): ConditionGroup => ({
+  id: uuidv4(),
+  operator: 'AND',
+  rules: [],
+})
+
+const defaultDefinition = (): RuleDefinition => ({
+  conditions: defaultConditionGroup(),
+  actions: [],
+  metadata: { executionOrder: 0, stopOnMatch: false, errorHandling: 'SKIP' },
+})
+
+export function RuleBuilder({
+  initialDefinition,
+  fieldCatalog,
+  onChange,
+  readOnly = false,
+}: RuleBuilderProps) {
+  const [definition, setDefinition] = useState<RuleDefinition>(
+    initialDefinition ?? defaultDefinition()
+  )
+  const [activeTab, setActiveTab] = useState<'builder' | 'preview' | 'json'>('builder')
+
+  const sensors = useSensors(useSensor(PointerSensor, { activationConstraint: { distance: 8 } }))
+
+  const updateDefinition = useCallback(
+    (updater: (prev: RuleDefinition) => RuleDefinition) => {
+      setDefinition((prev) => {
+        const next = updater(prev)
+        onChange(next)
+        return next
+      })
+    },
+    [onChange]
+  )
+
+  const handleConditionsChange = useCallback(
+    (conditions: ConditionGroup) => {
+      updateDefinition((prev) => ({ ...prev, conditions }))
+    },
+    [updateDefinition]
+  )
+
+  const handleActionsChange = useCallback(
+    (actions: RuleAction[]) => {
+      updateDefinition((prev) => ({ ...prev, actions }))
+    },
+    [updateDefinition]
+  )
+
+  const addAction = () => {
+    const newAction: RuleAction = {
+      id: uuidv4(),
+      type: 'SET_DECISION',
+      value: 'REJECT',
+    }
+    handleActionsChange([...definition.actions, newAction])
+  }
+
+  return (
+    <div className="flex flex-col h-full bg-gray-50">
+      {/* Tabs */}
+      <div className="flex border-b border-gray-200 bg-white px-6">
+        {(['builder', 'preview', 'json'] as const).map((tab) => (
+          <button
+            key={tab}
+            onClick={() => setActiveTab(tab)}
+            className={`py-3 px-6 text-sm font-medium capitalize border-b-2 transition-colors ${
+              activeTab === tab
+                ? 'border-blue-600 text-blue-600'
+                : 'border-transparent text-gray-500 hover:text-gray-700'
+            }`}
+          >
+            {tab === 'json' ? 'JSON View' : tab.charAt(0).toUpperCase() + tab.slice(1)}
+          </button>
+        ))}
+      </div>
+
+      {/* Content */}
+      <div className="flex-1 overflow-auto p-6">
+        {activeTab === 'builder' && (
+          <DndContext sensors={sensors} collisionDetection={closestCenter}>
+            <div className="max-w-4xl mx-auto space-y-6">
+              {/* CONDITIONS */}
+              <section className="bg-white rounded-xl shadow-sm border border-gray-200">
+                <div className="flex items-center justify-between px-6 py-4 border-b border-gray-100">
+                  <div className="flex items-center gap-3">
+                    <div className="w-8 h-8 rounded-lg bg-blue-100 flex items-center justify-center">
+                      <span className="text-blue-600 text-sm font-bold">IF</span>
+                    </div>
+                    <h2 className="text-base font-semibold text-gray-900">Conditions</h2>
+                    <span className="text-xs text-gray-400">
+                      Define when this rule should trigger
+                    </span>
+                  </div>
+                </div>
+                <div className="p-6">
+                  <ConditionGroupEditor
+                    group={definition.conditions}
+                    fieldCatalog={fieldCatalog}
+                    onChange={handleConditionsChange}
+                    readOnly={readOnly}
+                    depth={0}
+                  />
+                </div>
+              </section>
+
+              {/* ACTIONS */}
+              <section className="bg-white rounded-xl shadow-sm border border-gray-200">
+                <div className="flex items-center justify-between px-6 py-4 border-b border-gray-100">
+                  <div className="flex items-center gap-3">
+                    <div className="w-8 h-8 rounded-lg bg-emerald-100 flex items-center justify-center">
+                      <span className="text-emerald-600 text-sm font-bold">THEN</span>
+                    </div>
+                    <h2 className="text-base font-semibold text-gray-900">Actions</h2>
+                    <span className="text-xs text-gray-400">What happens when conditions match</span>
+                  </div>
+                  {!readOnly && (
+                    <button
+                      onClick={addAction}
+                      className="flex items-center gap-1 text-sm text-blue-600 hover:text-blue-700 font-medium"
+                    >
+                      <span className="text-lg leading-none">+</span> Add Action
+                    </button>
+                  )}
+                </div>
+                <div className="p-6 space-y-3">
+                  {definition.actions.length === 0 ? (
+                    <div className="text-center py-8 text-gray-400">
+                      <p className="text-sm">No actions defined yet.</p>
+                      {!readOnly && (
+                        <button
+                          onClick={addAction}
+                          className="mt-2 text-sm text-blue-600 hover:text-blue-700"
+                        >
+                          + Add your first action
+                        </button>
+                      )}
+                    </div>
+                  ) : (
+                    definition.actions.map((action, idx) => (
+                      <ActionEditor
+                        key={action.id}
+                        action={action}
+                        index={idx}
+                        readOnly={readOnly}
+                        onChange={(updated) => {
+                          const next = [...definition.actions]
+                          next[idx] = updated
+                          handleActionsChange(next)
+                        }}
+                        onDelete={() => {
+                          handleActionsChange(definition.actions.filter((_, i) => i !== idx))
+                        }}
+                      />
+                    ))
+                  )}
+                </div>
+              </section>
+
+              {/* METADATA */}
+              <section className="bg-white rounded-xl shadow-sm border border-gray-200">
+                <div className="px-6 py-4 border-b border-gray-100">
+                  <h2 className="text-base font-semibold text-gray-900">Rule Settings</h2>
+                </div>
+                <div className="p-6 grid grid-cols-3 gap-4">
+                  <label className="flex flex-col gap-1">
+                    <span className="text-xs font-medium text-gray-600">Execution Order</span>
+                    <input
+                      type="number"
+                      value={definition.metadata?.executionOrder ?? 0}
+                      disabled={readOnly}
+                      onChange={(e) =>
+                        updateDefinition((prev) => ({
+                          ...prev,
+                          metadata: { ...prev.metadata, executionOrder: Number(e.target.value) },
+                        }))
+                      }
+                      className="border border-gray-200 rounded-lg px-3 py-2 text-sm focus:ring-2 focus:ring-blue-500 focus:border-transparent"
+                    />
+                  </label>
+                  <label className="flex flex-col gap-1">
+                    <span className="text-xs font-medium text-gray-600">Error Handling</span>
+                    <select
+                      value={definition.metadata?.errorHandling ?? 'SKIP'}
+                      disabled={readOnly}
+                      onChange={(e) =>
+                        updateDefinition((prev) => ({
+                          ...prev,
+                          metadata: {
+                            ...prev.metadata,
+                            errorHandling: e.target.value as 'SKIP' | 'FAIL' | 'USE_DEFAULT',
+                          },
+                        }))
+                      }
+                      className="border border-gray-200 rounded-lg px-3 py-2 text-sm focus:ring-2 focus:ring-blue-500"
+                    >
+                      <option value="SKIP">Skip on Error</option>
+                      <option value="FAIL">Fail on Error</option>
+                      <option value="USE_DEFAULT">Use Default</option>
+                    </select>
+                  </label>
+                  <label className="flex items-center gap-3 mt-5">
+                    <input
+                      type="checkbox"
+                      checked={definition.metadata?.stopOnMatch ?? false}
+                      disabled={readOnly}
+                      onChange={(e) =>
+                        updateDefinition((prev) => ({
+                          ...prev,
+                          metadata: { ...prev.metadata, stopOnMatch: e.target.checked },
+                        }))
+                      }
+                      className="w-4 h-4 rounded border-gray-300 text-blue-600"
+                    />
+                    <span className="text-sm font-medium text-gray-700">Stop on Match</span>
+                  </label>
+                </div>
+              </section>
+            </div>
+          </DndContext>
+        )}
+
+        {activeTab === 'preview' && (
+          <RulePreview definition={definition} fieldCatalog={fieldCatalog} />
+        )}
+
+        {activeTab === 'json' && (
+          <div className="max-w-4xl mx-auto">
+            <div className="bg-gray-900 rounded-xl p-6 overflow-auto">
+              <pre className="text-green-400 text-sm font-mono whitespace-pre-wrap">
+                {JSON.stringify(definition, null, 2)}
+              </pre>
+            </div>
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}

RuleDesignerController.cs

@@ -0,0 +1,458 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using OptimAI.BRE.RuleEngine.Api;
+using OptimAI.BRE.Shared.Domain;
+
+namespace OptimAI.BRE.RuleDesigner.Api;
+
+[ApiController]
+[Route("api/v1/rules")]
+[Authorize]
+public sealed class RuleDesignerController : ControllerBase
+{
+    private readonly IRuleRepository _ruleRepo;
+    private readonly IRuleVersionRepository _versionRepo;
+    private readonly IRuleApprovalService _approvalService;
+    private readonly IAuditService _auditService;
+    private readonly ITenantContextAccessor _tenantAccessor;
+
+    public RuleDesignerController(
+        IRuleRepository ruleRepo,
+        IRuleVersionRepository versionRepo,
+        IRuleApprovalService approvalService,
+        IAuditService auditService,
+        ITenantContextAccessor tenantAccessor)
+    {
+        _ruleRepo = ruleRepo;
+        _versionRepo = versionRepo;
+        _approvalService = approvalService;
+        _auditService = auditService;
+        _tenantAccessor = tenantAccessor;
+    }
+
+    [HttpGet]
+    [ProducesResponseType(typeof(PagedResponse<RuleSummaryDto>), 200)]
+    public async Task<IActionResult> GetRules(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 20,
+        [FromQuery] string? category = null,
+        [FromQuery] string? ruleType = null,
+        [FromQuery] string? status = null,
+        [FromQuery] string? search = null,
+        CancellationToken ct = default)
+    {
+        var result = await _ruleRepo.GetPagedAsync(new RuleQuery
+        {
+            TenantId = _tenantAccessor.TenantId,
+            Page = page,
+            PageSize = Math.Min(pageSize, 100),
+            Category = category,
+            RuleType = ruleType,
+            Status = status,
+            Search = search
+        }, ct);
+
+        return Ok(result);
+    }
+
+    [HttpGet("{id:guid}")]
+    [ProducesResponseType(typeof(RuleDetailDto), 200)]
+    [ProducesResponseType(404)]
+    public async Task<IActionResult> GetRule(Guid id, CancellationToken ct)
+    {
+        var rule = await _ruleRepo.GetByIdAsync(id, _tenantAccessor.TenantId, ct);
+        if (rule == null) return NotFound();
+        return Ok(MapToDetailDto(rule));
+    }
+
+    [HttpPost]
+    [Authorize(Policy = "RuleWrite")]
+    [ProducesResponseType(typeof(RuleDetailDto), 201)]
+    public async Task<IActionResult> CreateRule([FromBody] CreateRuleRequest request, CancellationToken ct)
+    {
+        var rule = new Rule
+        {
+            TenantId = _tenantAccessor.TenantId,
+            RuleCode = request.RuleCode ?? GenerateRuleCode(request.RuleName),
+            RuleName = request.RuleName,
+            Description = request.Description,
+            CategoryId = request.CategoryId,
+            RuleType = Enum.Parse<RuleType>(request.RuleType, true),
+            Priority = request.Priority,
+            Tags = request.Tags ?? new(),
+            Status = RuleStatus.Draft,
+            CreatedBy = _tenantAccessor.UserId
+        };
+
+        var version = new RuleVersion
+        {
+            TenantId = _tenantAccessor.TenantId,
+            VersionNumber = 1,
+            VersionLabel = "v1.0",
+            RuleDefinition = request.RuleDefinition,
+            Status = RuleStatus.Draft,
+            IsCurrent = true,
+            CreatedBy = _tenantAccessor.UserId
+        };
+
+        var created = await _ruleRepo.CreateWithVersionAsync(rule, version, ct);
+
+        await _auditService.LogAsync(new AuditLog
+        {
+            TenantId = _tenantAccessor.TenantId,
+            UserId = _tenantAccessor.UserId,
+            Action = "RULE_CREATED",
+            EntityType = "RULE",
+            EntityId = created.Id.ToString(),
+            NewValues = new Dictionary<string, object> { ["ruleCode"] = created.RuleCode, ["ruleName"] = created.RuleName }
+        }, ct);
+
+        return CreatedAtAction(nameof(GetRule), new { id = created.Id }, MapToDetailDto(created));
+    }
+
+    [HttpPut("{id:guid}")]
+    [Authorize(Policy = "RuleWrite")]
+    [ProducesResponseType(typeof(RuleDetailDto), 200)]
+    [ProducesResponseType(404)]
+    public async Task<IActionResult> UpdateRule(Guid id, [FromBody] UpdateRuleRequest request, CancellationToken ct)
+    {
+        var rule = await _ruleRepo.GetByIdAsync(id, _tenantAccessor.TenantId, ct);
+        if (rule == null) return NotFound();
+
+        var oldValues = new Dictionary<string, object> { ["ruleName"] = rule.RuleName, ["status"] = rule.Status.ToString() };
+
+        // Create new version
+        var latestVersion = await _versionRepo.GetLatestAsync(id, ct);
+        var newVersionNumber = (latestVersion?.VersionNumber ?? 0) + 1;
+
+        var newVersion = new RuleVersion
+        {
+            TenantId = _tenantAccessor.TenantId,
+            RuleId = id,
+            VersionNumber = newVersionNumber,
+            VersionLabel = $"v{newVersionNumber}.0",
+            RuleDefinition = request.RuleDefinition,
+            ChangeSummary = request.ChangeSummary,
+            Status = RuleStatus.Draft,
+            IsCurrent = false,
+            CreatedBy = _tenantAccessor.UserId
+        };
+
+        rule.RuleName = request.RuleName ?? rule.RuleName;
+        rule.Description = request.Description ?? rule.Description;
+        rule.Priority = request.Priority ?? rule.Priority;
+        rule.Tags = request.Tags ?? rule.Tags;
+        rule.Status = RuleStatus.Draft;
+        rule.IsPublished = false;
+
+        await _ruleRepo.UpdateWithNewVersionAsync(rule, newVersion, ct);
+
+        await _auditService.LogAsync(new AuditLog
+        {
+            TenantId = _tenantAccessor.TenantId,
+            UserId = _tenantAccessor.UserId,
+            Action = "RULE_UPDATED",
+            EntityType = "RULE",
+            EntityId = id.ToString(),
+            OldValues = oldValues,
+            NewValues = new Dictionary<string, object>
+            {
+                ["ruleName"] = rule.RuleName,
+                ["versionNumber"] = newVersionNumber,
+                ["changeSummary"] = request.ChangeSummary ?? ""
+            }
+        }, ct);
+
+        var updated = await _ruleRepo.GetByIdAsync(id, _tenantAccessor.TenantId, ct);
+        return Ok(MapToDetailDto(updated!));
+    }
+
+    [HttpPost("{id:guid}/submit-for-approval")]
+    [Authorize(Policy = "RuleWrite")]
+    public async Task<IActionResult> SubmitForApproval(Guid id, [FromBody] SubmitApprovalRequest request, CancellationToken ct)
+    {
+        var rule = await _ruleRepo.GetByIdAsync(id, _tenantAccessor.TenantId, ct);
+        if (rule == null) return NotFound();
+
+        await _approvalService.SubmitForApprovalAsync(id, rule.CurrentVersionId!.Value, _tenantAccessor.TenantId, _tenantAccessor.UserId, request.Comments, ct);
+
+        return Ok(new { message = "Rule submitted for approval", status = "PENDING_APPROVAL" });
+    }
+
+    [HttpPost("{id:guid}/approve")]
+    [Authorize(Policy = "RuleApprove")]
+    public async Task<IActionResult> ApproveRule(Guid id, [FromBody] ApproveRuleRequest request, CancellationToken ct)
+    {
+        await _approvalService.ApproveAsync(id, _tenantAccessor.TenantId, _tenantAccessor.UserId, request.Comments, ct);
+
+        await _auditService.LogAsync(new AuditLog
+        {
+            TenantId = _tenantAccessor.TenantId,
+            UserId = _tenantAccessor.UserId,
+            Action = "RULE_APPROVED",
+            EntityType = "RULE",
+            EntityId = id.ToString()
+        }, ct);
+
+        return Ok(new { message = "Rule approved successfully" });
+    }
+
+    [HttpPost("{id:guid}/reject")]
+    [Authorize(Policy = "RuleApprove")]
+    public async Task<IActionResult> RejectRule(Guid id, [FromBody] RejectRuleRequest request, CancellationToken ct)
+    {
+        await _approvalService.RejectAsync(id, _tenantAccessor.TenantId, _tenantAccessor.UserId, request.Comments, ct);
+        return Ok(new { message = "Rule rejected" });
+    }
+
+    [HttpPost("{id:guid}/publish")]
+    [Authorize(Policy = "RulePublish")]
+    public async Task<IActionResult> PublishRule(Guid id, CancellationToken ct)
+    {
+        var rule = await _ruleRepo.GetByIdAsync(id, _tenantAccessor.TenantId, ct);
+        if (rule == null) return NotFound();
+        if (rule.Status != RuleStatus.Approved) return BadRequest(new { error = "Rule must be approved before publishing" });
+
+        await _ruleRepo.PublishAsync(id, _tenantAccessor.TenantId, _tenantAccessor.UserId, ct);
+
+        await _auditService.LogAsync(new AuditLog
+        {
+            TenantId = _tenantAccessor.TenantId,
+            UserId = _tenantAccessor.UserId,
+            Action = "RULE_PUBLISHED",
+            EntityType = "RULE",
+            EntityId = id.ToString()
+        }, ct);
+
+        return Ok(new { message = "Rule published to production" });
+    }
+
+    [HttpPost("{id:guid}/clone")]
+    [Authorize(Policy = "RuleWrite")]
+    public async Task<IActionResult> CloneRule(Guid id, [FromBody] CloneRuleRequest request, CancellationToken ct)
+    {
+        var original = await _ruleRepo.GetByIdAsync(id, _tenantAccessor.TenantId, ct);
+        if (original == null) return NotFound();
+
+        var cloned = await _ruleRepo.CloneAsync(id, _tenantAccessor.TenantId, _tenantAccessor.UserId, request.NewRuleCode, request.NewRuleName, ct);
+
+        return CreatedAtAction(nameof(GetRule), new { id = cloned.Id }, MapToDetailDto(cloned));
+    }
+
+    [HttpPatch("{id:guid}/toggle")]
+    [Authorize(Policy = "RuleWrite")]
+    public async Task<IActionResult> ToggleRule(Guid id, CancellationToken ct)
+    {
+        var rule = await _ruleRepo.GetByIdAsync(id, _tenantAccessor.TenantId, ct);
+        if (rule == null) return NotFound();
+
+        await _ruleRepo.ToggleActiveAsync(id, _tenantAccessor.TenantId, ct);
+        return Ok(new { message = $"Rule {(rule.IsActive ? "disabled" : "enabled")}", isActive = !rule.IsActive });
+    }
+
+    [HttpGet("{id:guid}/versions")]
+    [ProducesResponseType(typeof(List<RuleVersionSummaryDto>), 200)]
+    public async Task<IActionResult> GetVersions(Guid id, CancellationToken ct)
+    {
+        var versions = await _versionRepo.GetAllAsync(id, _tenantAccessor.TenantId, ct);
+        return Ok(versions.Select(v => new RuleVersionSummaryDto
+        {
+            Id = v.Id,
+            VersionNumber = v.VersionNumber,
+            VersionLabel = v.VersionLabel ?? $"v{v.VersionNumber}.0",
+            Status = v.Status.ToString(),
+            ChangeSummary = v.ChangeSummary,
+            IsCurrent = v.IsCurrent,
+            CreatedAt = v.CreatedAt,
+            ApprovedAt = v.ApprovedAt,
+            PublishedAt = v.PublishedAt
+        }).ToList());
+    }
+
+    [HttpPut("{id:guid}/scopes")]
+    [Authorize(Policy = "RuleWrite")]
+    public async Task<IActionResult> UpdateScopes(Guid id, [FromBody] UpdateScopesRequest request, CancellationToken ct)
+    {
+        await _ruleRepo.UpdateScopesAsync(id, _tenantAccessor.TenantId, request.Scopes, ct);
+        return Ok(new { message = "Rule scopes updated" });
+    }
+
+    private static string GenerateRuleCode(string ruleName)
+    {
+        return ruleName.ToLower()
+            .Replace(" ", "_")
+            .Replace("-", "_")
+            .Replace("/", "_")
+            [..Math.Min(ruleName.Length, 80)];
+    }
+
+    private static RuleDetailDto MapToDetailDto(Rule rule) => new()
+    {
+        Id = rule.Id,
+        RuleCode = rule.RuleCode,
+        RuleName = rule.RuleName,
+        Description = rule.Description,
+        CategoryId = rule.CategoryId,
+        RuleType = rule.RuleType.ToString(),
+        Priority = rule.Priority,
+        IsActive = rule.IsActive,
+        IsPublished = rule.IsPublished,
+        Status = rule.Status.ToString(),
+        Tags = rule.Tags,
+        CurrentVersion = rule.CurrentVersion != null ? new RuleVersionDto
+        {
+            Id = rule.CurrentVersion.Id,
+            VersionNumber = rule.CurrentVersion.VersionNumber,
+            VersionLabel = rule.CurrentVersion.VersionLabel ?? $"v{rule.CurrentVersion.VersionNumber}.0",
+            RuleDefinition = rule.CurrentVersion.RuleDefinition,
+            Status = rule.CurrentVersion.Status.ToString(),
+            CreatedAt = rule.CurrentVersion.CreatedAt
+        } : null,
+        Scopes = rule.Scopes.Select(s => new RuleScopeDto
+        {
+            ScopeType = s.ScopeType.ToString(),
+            ScopeValue = s.ScopeValue,
+            IsExcluded = s.IsExcluded
+        }).ToList(),
+        CreatedAt = rule.CreatedAt,
+        UpdatedAt = rule.UpdatedAt
+    };
+}
+
+// ============================================================
+// DTOs
+// ============================================================
+
+public record RuleSummaryDto
+{
+    public Guid Id { get; init; }
+    public string RuleCode { get; init; } = default!;
+    public string RuleName { get; init; } = default!;
+    public string RuleType { get; init; } = default!;
+    public string Status { get; init; } = default!;
+    public bool IsActive { get; init; }
+    public bool IsPublished { get; init; }
+    public int Priority { get; init; }
+    public List<string> Tags { get; init; } = new();
+    public int VersionCount { get; init; }
+    public DateTime CreatedAt { get; init; }
+    public DateTime UpdatedAt { get; init; }
+}
+
+public record RuleDetailDto : RuleSummaryDto
+{
+    public string? Description { get; init; }
+    public Guid? CategoryId { get; init; }
+    public RuleVersionDto? CurrentVersion { get; init; }
+    public List<RuleScopeDto> Scopes { get; init; } = new();
+}
+
+public record RuleVersionDto
+{
+    public Guid Id { get; init; }
+    public int VersionNumber { get; init; }
+    public string VersionLabel { get; init; } = default!;
+    public RuleDefinition RuleDefinition { get; init; } = default!;
+    public string Status { get; init; } = default!;
+    public DateTime CreatedAt { get; init; }
+}
+
+public record RuleVersionSummaryDto
+{
+    public Guid Id { get; init; }
+    public int VersionNumber { get; init; }
+    public string VersionLabel { get; init; } = default!;
+    public string Status { get; init; } = default!;
+    public string? ChangeSummary { get; init; }
+    public bool IsCurrent { get; init; }
+    public DateTime CreatedAt { get; init; }
+    public DateTime? ApprovedAt { get; init; }
+    public DateTime? PublishedAt { get; init; }
+}
+
+public record RuleScopeDto
+{
+    public string ScopeType { get; init; } = default!;
+    public string ScopeValue { get; init; } = default!;
+    public bool IsExcluded { get; init; }
+}
+
+public record CreateRuleRequest
+{
+    public string RuleName { get; init; } = default!;
+    public string? RuleCode { get; init; }
+    public string? Description { get; init; }
+    public Guid? CategoryId { get; init; }
+    public string RuleType { get; init; } = default!;
+    public int Priority { get; init; } = 100;
+    public List<string>? Tags { get; init; }
+    public RuleDefinition RuleDefinition { get; init; } = default!;
+}
+
+public record UpdateRuleRequest
+{
+    public string? RuleName { get; init; }
+    public string? Description { get; init; }
+    public int? Priority { get; init; }
+    public List<string>? Tags { get; init; }
+    public string? ChangeSummary { get; init; }
+    public RuleDefinition RuleDefinition { get; init; } = default!;
+}
+
+public record SubmitApprovalRequest { public string? Comments { get; init; } }
+public record ApproveRuleRequest { public string? Comments { get; init; } }
+public record RejectRuleRequest { public string Comments { get; init; } = default!; }
+public record CloneRuleRequest { public string? NewRuleCode { get; init; } public string? NewRuleName { get; init; } }
+
+public record UpdateScopesRequest
+{
+    public List<RuleScopeRequest> Scopes { get; init; } = new();
+}
+
+public record RuleScopeRequest
+{
+    public string ScopeType { get; init; } = default!;
+    public string ScopeValue { get; init; } = default!;
+    public bool IsExcluded { get; init; }
+}
+
+public record RuleQuery
+{
+    public Guid TenantId { get; init; }
+    public int Page { get; init; } = 1;
+    public int PageSize { get; init; } = 20;
+    public string? Category { get; init; }
+    public string? RuleType { get; init; }
+    public string? Status { get; init; }
+    public string? Search { get; init; }
+}
+
+public interface IRuleRepository
+{
+    Task<PagedResponse<RuleSummaryDto>> GetPagedAsync(RuleQuery query, CancellationToken ct = default);
+    Task<Rule?> GetByIdAsync(Guid id, Guid tenantId, CancellationToken ct = default);
+    Task<Rule> CreateWithVersionAsync(Rule rule, RuleVersion version, CancellationToken ct = default);
+    Task UpdateWithNewVersionAsync(Rule rule, RuleVersion newVersion, CancellationToken ct = default);
+    Task PublishAsync(Guid id, Guid tenantId, Guid publishedBy, CancellationToken ct = default);
+    Task<Rule> CloneAsync(Guid id, Guid tenantId, Guid clonedBy, string? newCode, string? newName, CancellationToken ct = default);
+    Task ToggleActiveAsync(Guid id, Guid tenantId, CancellationToken ct = default);
+    Task UpdateScopesAsync(Guid id, Guid tenantId, List<RuleScopeRequest> scopes, CancellationToken ct = default);
+}
+
+public interface IRuleVersionRepository
+{
+    Task<RuleVersion?> GetLatestAsync(Guid ruleId, CancellationToken ct = default);
+    Task<List<RuleVersion>> GetAllAsync(Guid ruleId, Guid tenantId, CancellationToken ct = default);
+}
+
+public interface IRuleApprovalService
+{
+    Task SubmitForApprovalAsync(Guid ruleId, Guid versionId, Guid tenantId, Guid requestedBy, string? comments, CancellationToken ct = default);
+    Task ApproveAsync(Guid ruleId, Guid tenantId, Guid approvedBy, string? comments, CancellationToken ct = default);
+    Task RejectAsync(Guid ruleId, Guid tenantId, Guid rejectedBy, string comments, CancellationToken ct = default);
+}
+
+public interface IAuditService
+{
+    Task LogAsync(AuditLog log, CancellationToken ct = default);
+}

RuleExecutionService.cs

@@ -0,0 +1,264 @@
+using System.Diagnostics;
+using Microsoft.Extensions.Logging;
+using OptimAI.BRE.RuleEngine.Domain;
+using OptimAI.BRE.Shared.Domain;
+
+namespace OptimAI.BRE.RuleEngine.Application;
+
+public sealed class RuleExecutionService : IRuleExecutionService
+{
+    private readonly IRuleLoader _ruleLoader;
+    private readonly IConditionEvaluator _conditionEvaluator;
+    private readonly IActionExecutor _actionExecutor;
+    private readonly IRiskScoringEngine _riskScoringEngine;
+    private readonly ILogger<RuleExecutionService> _logger;
+
+    public RuleExecutionService(
+        IRuleLoader ruleLoader,
+        IConditionEvaluator conditionEvaluator,
+        IActionExecutor actionExecutor,
+        IRiskScoringEngine riskScoringEngine,
+        ILogger<RuleExecutionService> logger)
+    {
+        _ruleLoader = ruleLoader;
+        _conditionEvaluator = conditionEvaluator;
+        _actionExecutor = actionExecutor;
+        _riskScoringEngine = riskScoringEngine;
+        _logger = logger;
+    }
+
+    public async Task<ExecutionResult> ExecuteAsync(ExecutionContext context, CancellationToken ct = default)
+    {
+        var sw = Stopwatch.StartNew();
+        var state = new ExecutionState();
+        var ruleResults = new List<RuleEvaluationResult>();
+
+        try
+        {
+            var rules = await _ruleLoader.LoadRulesAsync(new RuleLoadRequest
+            {
+                TenantId = context.TenantId,
+                ProductCode = context.ProductCode,
+                BranchCode = context.BranchCode,
+                StageCode = context.StageCode,
+                RuleSetId = context.RuleSetId,
+                PublishedOnly = true
+            }, ct);
+
+            _logger.LogInformation("Executing {Count} rules for tenant {TenantId}, correlation {CorrelationId}",
+                rules.Count, context.TenantId, context.CorrelationId);
+
+            var executionState = new RuleExecutionState
+            {
+                GlobalState = state,
+                Data = context.Data,
+                TenantId = context.TenantId
+            };
+
+            var orderedRules = rules.OrderBy(r => r.Priority).ToList();
+            int executionOrder = 0;
+
+            foreach (var rule in orderedRules)
+            {
+                if (ct.IsCancellationRequested) break;
+                if (state.ShouldStop) break;
+
+                var ruleResult = await EvaluateRuleAsync(rule, context, ct);
+                ruleResult.ExecutionOrder = ++executionOrder;
+                ruleResults.Add(ruleResult);
+
+                if (ruleResult.IsMatched && !ruleResult.HasError)
+                {
+                    foreach (var action in rule.CurrentVersion!.RuleDefinition.Actions)
+                    {
+                        await _actionExecutor.ExecuteAsync(action, context, executionState);
+                    }
+
+                    if (context.Options.StopOnFirstReject && state.CurrentDecision == Decision.Reject)
+                    {
+                        state.ShouldStop = true;
+                    }
+                }
+            }
+
+            // Calculate risk score
+            var riskResult = await _riskScoringEngine.CalculateAsync(context, ruleResults);
+            state.RiskScore = riskResult.Score;
+
+            // Determine final traffic light
+            state.TrafficLight = DetermineTrafficLight(state.CurrentDecision, riskResult.Category);
+
+            sw.Stop();
+
+            return BuildResult(context, state, ruleResults, riskResult, sw.ElapsedMilliseconds);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Rule execution failed for tenant {TenantId}", context.TenantId);
+            throw;
+        }
+    }
+
+    public async Task<RuleEvaluationResult> EvaluateRuleAsync(Rule rule, ExecutionContext context, CancellationToken ct = default)
+    {
+        var sw = Stopwatch.StartNew();
+        var result = new RuleEvaluationResult
+        {
+            RuleId = rule.Id,
+            RuleCode = rule.RuleCode,
+            RuleName = rule.RuleName,
+            VersionNumber = rule.CurrentVersion?.VersionNumber ?? 0
+        };
+
+        try
+        {
+            if (rule.CurrentVersion?.RuleDefinition == null)
+            {
+                result.HasError = true;
+                result.ErrorMessage = "Rule has no published version";
+                return result;
+            }
+
+            var definition = rule.CurrentVersion.RuleDefinition;
+
+            // Evaluate conditions with detailed tracking
+            var (matched, conditionResults) = await EvaluateConditionGroupDetailedAsync(
+                definition.Conditions, context.Data);
+
+            result.IsMatched = matched;
+            result.ConditionResults = conditionResults;
+        }
+        catch (Exception ex)
+        {
+            result.HasError = true;
+            result.ErrorMessage = ex.Message;
+            _logger.LogWarning(ex, "Error evaluating rule {RuleCode}", rule.RuleCode);
+        }
+        finally
+        {
+            sw.Stop();
+            result.ExecutionMs = (int)sw.ElapsedMilliseconds;
+        }
+
+        return result;
+    }
+
+    public async Task<bool> EvaluateConditionGroupAsync(ConditionGroup group, DynamicDataContext data, CancellationToken ct = default)
+    {
+        var results = new List<bool>();
+
+        foreach (var node in group.Rules)
+        {
+            bool nodeResult;
+            if (node.IsGroup && node.Group != null)
+                nodeResult = await EvaluateConditionGroupAsync(node.Group, data, ct);
+            else
+                nodeResult = _conditionEvaluator.Evaluate(node, data);
+
+            results.Add(nodeResult);
+        }
+
+        return group.Operator switch
+        {
+            LogicalOperator.And => results.All(r => r),
+            LogicalOperator.Or => results.Any(r => r),
+            LogicalOperator.Not => results.Count > 0 && !results[0],
+            _ => false
+        };
+    }
+
+    private async Task<(bool matched, List<ConditionEvaluationResult> details)> EvaluateConditionGroupDetailedAsync(
+        ConditionGroup group, DynamicDataContext data)
+    {
+        var details = new List<ConditionEvaluationResult>();
+        var results = new List<bool>();
+
+        foreach (var node in group.Rules)
+        {
+            bool nodeResult;
+            if (node.IsGroup && node.Group != null)
+            {
+                var (groupResult, groupDetails) = await EvaluateConditionGroupDetailedAsync(node.Group, data);
+                nodeResult = groupResult;
+                details.AddRange(groupDetails);
+            }
+            else
+            {
+                var actualValue = data.GetValue(node.Field!);
+                nodeResult = _conditionEvaluator.Evaluate(node, data);
+                details.Add(new ConditionEvaluationResult
+                {
+                    ConditionId = node.Id,
+                    Field = node.Field ?? "",
+                    Operator = node.Operator?.ToString() ?? "",
+                    ExpectedValue = node.Value,
+                    ActualValue = actualValue,
+                    Result = nodeResult
+                });
+            }
+            results.Add(nodeResult);
+        }
+
+        bool finalResult = group.Operator switch
+        {
+            LogicalOperator.And => results.All(r => r),
+            LogicalOperator.Or => results.Any(r => r),
+            LogicalOperator.Not => results.Count > 0 && !results[0],
+            _ => false
+        };
+
+        return (finalResult, details);
+    }
+
+    private static TrafficLight DetermineTrafficLight(Decision decision, RiskCategory riskCategory)
+    {
+        return decision switch
+        {
+            Decision.Approve when riskCategory is RiskCategory.Low or RiskCategory.Medium => TrafficLight.Green,
+            Decision.Reject => TrafficLight.Red,
+            Decision.Deviation => TrafficLight.Amber,
+            _ => riskCategory switch
+            {
+                RiskCategory.Critical => TrafficLight.Red,
+                RiskCategory.High => TrafficLight.Amber,
+                _ => TrafficLight.Green
+            }
+        };
+    }
+
+    private static ExecutionResult BuildResult(
+        ExecutionContext context,
+        ExecutionState state,
+        List<RuleEvaluationResult> ruleResults,
+        RiskScoreResult riskResult,
+        long elapsedMs)
+    {
+        return new ExecutionResult
+        {
+            TenantId = context.TenantId,
+            FinalDecision = state.CurrentDecision,
+            RiskScore = state.RiskScore,
+            RiskCategory = riskResult.Category,
+            TrafficLight = state.TrafficLight,
+            TotalRulesEvaluated = ruleResults.Count,
+            RulesPassed = ruleResults.Count(r => r.IsMatched),
+            RulesFailed = ruleResults.Count(r => !r.IsMatched),
+            RulesSkipped = ruleResults.Count(r => r.HasError),
+            DeviationsCount = state.Deviations.Count,
+            ExecutionMs = (int)elapsedMs,
+            RuleResults = ruleResults.Select(r => new RuleExecutionSummary
+            {
+                RuleId = r.RuleId,
+                RuleCode = r.RuleCode,
+                RuleName = r.RuleName,
+                VersionNumber = r.VersionNumber,
+                IsMatched = r.IsMatched,
+                ConditionsEvaluated = r.ConditionResults,
+                ActionsExecuted = r.ExecutedActions,
+                ExecutionMs = r.ExecutionMs,
+                ErrorMessage = r.ErrorMessage
+            }).ToList(),
+            FieldValues = state.OutputFields
+        };
+    }
+}

RulePreview.tsx

@@ -0,0 +1,176 @@
+'use client'
+
+import React from 'react'
+import type { RuleDefinition, ConditionGroup, ConditionNode, RuleAction, FieldCatalogEntry } from '@/types'
+
+interface Props {
+  definition: RuleDefinition
+  fieldCatalog: FieldCatalogEntry[]
+}
+
+const OPERATOR_LABELS: Record<string, string> = {
+  EQUALS: '=',
+  NOT_EQUALS: '≠',
+  GREATER_THAN: '>',
+  GREATER_THAN_OR_EQUAL: '≥',
+  LESS_THAN: '<',
+  LESS_THAN_OR_EQUAL: '≤',
+  BETWEEN: 'between',
+  IN: 'in',
+  NOT_IN: 'not in',
+  CONTAINS: 'contains',
+  IS_NULL: 'is empty',
+  IS_NOT_NULL: 'is not empty',
+  IS_TRUE: 'is true',
+  IS_FALSE: 'is false',
+  REGEX: 'matches',
+}
+
+const ACTION_COLORS: Record<string, string> = {
+  SET_DECISION: 'bg-red-100 text-red-800',
+  SET_RISK: 'bg-yellow-100 text-yellow-800',
+  SET_TRAFFIC_LIGHT: 'bg-green-100 text-green-800',
+  ADD_DEVIATION: 'bg-orange-100 text-orange-800',
+  SET_FIELD: 'bg-blue-100 text-blue-800',
+  ADD_TAG: 'bg-purple-100 text-purple-800',
+  SET_SCORE: 'bg-teal-100 text-teal-800',
+}
+
+export function RulePreview({ definition, fieldCatalog }: Props) {
+  const getFieldName = (path: string) =>
+    fieldCatalog.find((f) => f.fieldPath === path)?.displayName ?? path
+
+  const renderConditionGroup = (group: ConditionGroup, depth = 0): React.ReactNode => {
+    const indent = depth * 24
+
+    return (
+      <div style={{ marginLeft: indent }} className="space-y-1">
+        {group.rules.map((node, idx) => (
+          <div key={node.id}>
+            {idx > 0 && (
+              <div className="flex items-center gap-2 my-1">
+                <div className="w-4 h-px bg-gray-300" />
+                <span className={`px-2 py-0.5 rounded text-xs font-bold ${
+                  group.operator === 'AND' ? 'bg-blue-100 text-blue-700' :
+                  group.operator === 'OR' ? 'bg-purple-100 text-purple-700' :
+                  'bg-red-100 text-red-700'
+                }`}>
+                  {group.operator}
+                </span>
+              </div>
+            )}
+            {renderNode(node, depth)}
+          </div>
+        ))}
+      </div>
+    )
+  }
+
+  const renderNode = (node: ConditionNode, depth: number): React.ReactNode => {
+    if (node.isGroup && node.group) {
+      return (
+        <div className="border-l-2 border-gray-200 pl-3 py-1">
+          <span className="text-xs text-gray-400 mb-1 block">{node.group.operator} group:</span>
+          {renderConditionGroup(node.group, depth + 1)}
+        </div>
+      )
+    }
+
+    return (
+      <div className="flex items-center gap-2 font-mono text-sm bg-gray-50 rounded-lg px-3 py-2 border border-gray-100">
+        <span className="text-blue-700 font-semibold">{getFieldName(node.field ?? '')}</span>
+        <span className="text-gray-500">{OPERATOR_LABELS[node.operator ?? ''] ?? node.operator}</span>
+        {node.value !== undefined && node.value !== '' && (
+          <span className="text-emerald-700 font-semibold">
+            {node.operator === 'BETWEEN'
+              ? `${node.value} and ${node.value2}`
+              : String(node.value)}
+          </span>
+        )}
+      </div>
+    )
+  }
+
+  const renderAction = (action: RuleAction): string => {
+    const colorClass = ACTION_COLORS[action.type] ?? 'bg-gray-100 text-gray-800'
+    switch (action.type) {
+      case 'SET_DECISION': return `Decision → ${action.value}`
+      case 'SET_RISK': return `Risk Level → ${action.value}`
+      case 'SET_TRAFFIC_LIGHT': return `Traffic Light → ${action.value}`
+      case 'ADD_DEVIATION': return `Deviation: ${action.value} (${action.parameters?.severity ?? 'MEDIUM'})`
+      case 'SET_FIELD': return `Set ${action.field} = ${action.value}`
+      case 'ADD_TAG': return `Tag: ${action.value}`
+      case 'SET_SCORE': return `Risk Score ${action.value?.startsWith?.('+') || action.value?.startsWith?.('-') ? 'adjust' : '='} ${action.value}`
+      default: return `${action.type}: ${action.value}`
+    }
+  }
+
+  const hasConditions = definition.conditions.rules.length > 0
+  const hasActions = definition.actions.length > 0
+
+  return (
+    <div className="max-w-3xl mx-auto">
+      <div className="bg-white rounded-xl shadow-sm border border-gray-200 overflow-hidden">
+        <div className="bg-gradient-to-r from-blue-600 to-blue-700 px-6 py-4">
+          <h2 className="text-white font-semibold text-lg">Rule Preview</h2>
+          <p className="text-blue-200 text-sm">Human-readable rule representation</p>
+        </div>
+
+        <div className="p-6 font-mono">
+          {/* IF block */}
+          <div className="mb-6">
+            <div className="flex items-center gap-3 mb-3">
+              <span className="px-3 py-1 bg-blue-600 text-white rounded-lg text-sm font-bold">IF</span>
+              <span className="text-gray-400 text-sm">all/any of these conditions match:</span>
+            </div>
+            {hasConditions ? (
+              renderConditionGroup(definition.conditions)
+            ) : (
+              <p className="text-gray-400 text-sm italic ml-4">No conditions defined</p>
+            )}
+          </div>
+
+          {/* Divider */}
+          <div className="border-t-2 border-dashed border-gray-200 my-4" />
+
+          {/* THEN block */}
+          <div>
+            <div className="flex items-center gap-3 mb-3">
+              <span className="px-3 py-1 bg-emerald-600 text-white rounded-lg text-sm font-bold">THEN</span>
+              <span className="text-gray-400 text-sm">execute these actions:</span>
+            </div>
+            {hasActions ? (
+              <div className="space-y-2 ml-4">
+                {definition.actions.map((action, idx) => (
+                  <div key={action.id} className="flex items-center gap-3">
+                    <span className="text-xs text-gray-400">{idx + 1}.</span>
+                    <span className={`px-2 py-1 rounded-lg text-xs font-semibold ${ACTION_COLORS[action.type] ?? 'bg-gray-100'}`}>
+                      {renderAction(action)}
+                    </span>
+                  </div>
+                ))}
+              </div>
+            ) : (
+              <p className="text-gray-400 text-sm italic ml-4">No actions defined</p>
+            )}
+          </div>
+
+          {/* Metadata */}
+          {definition.metadata && (
+            <>
+              <div className="border-t border-gray-100 mt-6 pt-4">
+                <div className="flex gap-4 text-xs text-gray-400">
+                  <span>Order: {definition.metadata.executionOrder ?? 0}</span>
+                  <span>Error: {definition.metadata.errorHandling ?? 'SKIP'}</span>
+                  {definition.metadata.stopOnMatch && (
+                    <span className="text-amber-600 font-medium">⚡ Stop on Match</span>
+                  )}
+                </div>
+              </div>
+            </>
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}

SandboxPage.tsx

@@ -0,0 +1,256 @@
+'use client'
+
+import React, { useState } from 'react'
+import { useMutation, useQuery } from '@tanstack/react-query'
+import Editor from '@monaco-editor/react'
+import type { BREDecisionResponse, PagedResponse } from '@/types'
+import type { Rule } from '@/types'
+import { apiClient } from '@/lib/api-client'
+import { AiAnalystPanel } from '../ai-analyst/AiAnalystPanel'
+
+const SAMPLE_PAYLOAD = JSON.stringify({
+  applicant: { age: 34, gender: "MALE", pan_number: "ABCDE1234F" },
+  employment: { type: "SALARIED", employer_name: "Infosys Ltd", monthly_income: 85000, vintage_months: 48 },
+  bureau: {
+    cibil_score: 712, experian_score: 708,
+    max_dpd_24m: 0, max_dpd_12m: 0,
+    total_active_loans: 2,
+    total_emi_obligation: 22000,
+    written_off_amount: 0,
+    suit_filed: false,
+    wilful_defaulter: false
+  },
+  loan: { amount: 750000, tenure_months: 60, purpose: "VEHICLE_PURCHASE" },
+  vehicle: { type: "TWO_WHEELER", make: "Honda", model: "Activa 6G", year: 2023, age_years: 0, valuation: 85000 },
+  ratios: { foir: 45.8, ltv: 88.2 },
+  fi: { verified: true, negative: false, address_match: true, mobile_match: true },
+  fraud: { score: 12, blacklisted: false }
+}, null, 2)
+
+export function SandboxPage() {
+  const [payload, setPayload] = useState(SAMPLE_PAYLOAD)
+  const [selectedRuleSetId, setSelectedRuleSetId] = useState<string>('')
+  const [result, setResult] = useState<BREDecisionResponse | null>(null)
+  const [error, setError] = useState<string | null>(null)
+  const [activeTab, setActiveTab] = useState<'input' | 'result' | 'ai'>('input')
+
+  const { data: ruleSets } = useQuery({
+    queryKey: ['rule-sets'],
+    queryFn: () => apiClient.get<{ items: { id: string; setName: string; setCode: string }[] }>('/rule-sets'),
+  })
+
+  const simulate = useMutation({
+    mutationFn: async () => {
+      const parsed = JSON.parse(payload)
+      return apiClient.post<BREDecisionResponse>('/simulate-decision', {
+        data: parsed,
+        ruleSetId: selectedRuleSetId || undefined,
+      })
+    },
+    onSuccess: (data) => {
+      setResult(data)
+      setError(null)
+      setActiveTab('result')
+    },
+    onError: (err: any) => {
+      setError(err.response?.data?.detail ?? err.message)
+    },
+  })
+
+  const isValidJson = (() => {
+    try { JSON.parse(payload); return true } catch { return false }
+  })()
+
+  return (
+    <div className="h-full flex flex-col">
+      {/* Header */}
+      <div className="px-6 py-4 border-b border-gray-200 bg-white">
+        <div className="flex items-center justify-between">
+          <div>
+            <h1 className="text-xl font-bold text-gray-900">Rule Testing Sandbox</h1>
+            <p className="text-sm text-gray-500 mt-0.5">Test rules before publishing to production</p>
+          </div>
+          <div className="flex items-center gap-3">
+            <select
+              value={selectedRuleSetId}
+              onChange={(e) => setSelectedRuleSetId(e.target.value)}
+              className="text-sm border border-gray-200 rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-blue-500"
+            >
+              <option value="">All Published Rules</option>
+              {ruleSets?.items.map((rs) => (
+                <option key={rs.id} value={rs.id}>{rs.setName}</option>
+              ))}
+            </select>
+            <button
+              onClick={() => simulate.mutate()}
+              disabled={!isValidJson || simulate.isPending}
+              className={`px-6 py-2 rounded-lg text-sm font-semibold text-white transition-colors flex items-center gap-2 ${
+                isValidJson && !simulate.isPending
+                  ? 'bg-blue-600 hover:bg-blue-700'
+                  : 'bg-gray-300 cursor-not-allowed'
+              }`}
+            >
+              {simulate.isPending ? (
+                <>
+                  <span className="animate-spin">⏳</span> Running...
+                </>
+              ) : (
+                <>▶ Run Simulation</>
+              )}
+            </button>
+          </div>
+        </div>
+      </div>
+
+      {/* Tabs */}
+      <div className="flex border-b border-gray-200 bg-white px-6">
+        {[
+          { id: 'input', label: '📥 Input JSON' },
+          { id: 'result', label: `📤 Decision ${result ? `(${result.decision})` : ''}` },
+          { id: 'ai', label: '🤖 AI Analysis' },
+        ].map(({ id, label }) => (
+          <button
+            key={id}
+            onClick={() => setActiveTab(id as any)}
+            disabled={id !== 'input' && !result}
+            className={`py-3 px-4 text-sm font-medium border-b-2 transition-colors ${
+              activeTab === id
+                ? 'border-blue-600 text-blue-600'
+                : 'border-transparent text-gray-500 hover:text-gray-700 disabled:opacity-40'
+            }`}
+          >
+            {label}
+          </button>
+        ))}
+      </div>
+
+      {/* Content */}
+      <div className="flex-1 overflow-auto">
+        {activeTab === 'input' && (
+          <div className="h-full flex flex-col">
+            <div className="flex-1">
+              <Editor
+                height="100%"
+                defaultLanguage="json"
+                value={payload}
+                onChange={(v) => setPayload(v ?? '')}
+                theme="vs-light"
+                options={{
+                  minimap: { enabled: false },
+                  fontSize: 13,
+                  lineNumbers: 'on',
+                  scrollBeyondLastLine: false,
+                  folding: true,
+                  formatOnPaste: true,
+                }}
+              />
+            </div>
+            {!isValidJson && (
+              <div className="px-6 py-2 bg-red-50 border-t border-red-200 text-sm text-red-700">
+                ⚠ Invalid JSON — fix before running simulation
+              </div>
+            )}
+            {error && (
+              <div className="px-6 py-3 bg-red-50 border-t border-red-200 text-sm text-red-700">
+                ❌ {error}
+              </div>
+            )}
+          </div>
+        )}
+
+        {activeTab === 'result' && result && (
+          <div className="p-6 space-y-6">
+            {/* Decision Header */}
+            <DecisionHeader result={result} />
+
+            {/* Rule Results */}
+            <div className="bg-white rounded-xl border border-gray-200">
+              <div className="px-5 py-4 border-b border-gray-100 flex items-center justify-between">
+                <h2 className="font-semibold text-gray-800">Rule Execution Results</h2>
+                <div className="flex gap-3 text-sm">
+                  <span className="text-emerald-600">{result.rulesPassed} matched</span>
+                  <span className="text-gray-400">•</span>
+                  <span className="text-gray-500">{result.rulesFailed} not matched</span>
+                </div>
+              </div>
+              <div className="divide-y divide-gray-50">
+                {result.ruleResults.map((r, idx) => (
+                  <div
+                    key={idx}
+                    className={`flex items-center gap-4 px-5 py-3 ${r.isMatched ? 'bg-emerald-50/30' : ''}`}
+                  >
+                    <div className={`w-5 h-5 rounded-full flex items-center justify-center text-xs ${
+                      r.isMatched ? 'bg-emerald-500 text-white' : 'bg-gray-200 text-gray-500'
+                    }`}>
+                      {r.isMatched ? '✓' : '✕'}
+                    </div>
+                    <div className="flex-1">
+                      <div className="text-sm font-medium text-gray-800">{r.ruleName}</div>
+                      <div className="text-xs text-gray-400 font-mono">{r.ruleCode}</div>
+                    </div>
+                    {r.isMatched && r.actionsExecuted.length > 0 && (
+                      <div className="flex gap-1 flex-wrap">
+                        {r.actionsExecuted.map((a, i) => (
+                          <span key={i} className="text-xs bg-blue-100 text-blue-700 px-2 py-0.5 rounded">{a}</span>
+                        ))}
+                      </div>
+                    )}
+                    <span className="text-xs text-gray-400 font-mono">{r.executionMs}ms</span>
+                  </div>
+                ))}
+              </div>
+            </div>
+          </div>
+        )}
+
+        {activeTab === 'ai' && result && (
+          <div className="p-6">
+            <AiAnalystPanel decision={result} />
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function DecisionHeader({ result }: { result: BREDecisionResponse }) {
+  const decisionColors = {
+    APPROVE: 'from-emerald-600 to-emerald-700',
+    REJECT: 'from-red-600 to-red-700',
+    DEVIATION: 'from-amber-600 to-amber-700',
+    REFER: 'from-blue-600 to-blue-700',
+    PENDING: 'from-gray-600 to-gray-700',
+  }
+
+  return (
+    <div className={`bg-gradient-to-r ${decisionColors[result.decision] ?? 'from-gray-600 to-gray-700'} rounded-xl p-6 text-white`}>
+      <div className="flex items-center justify-between">
+        <div>
+          <div className="text-white/70 text-sm font-medium mb-1">FINAL DECISION</div>
+          <div className="text-4xl font-black">{result.decision}</div>
+          <div className="text-white/70 text-sm mt-1">in {result.executionMs}ms</div>
+        </div>
+        <div className="text-right">
+          <div className="text-5xl font-black">{result.riskScore.toFixed(0)}</div>
+          <div className="text-white/70 text-sm">Risk Score /100</div>
+          <div className="mt-1 inline-block px-3 py-1 bg-white/20 rounded-full text-sm font-semibold">
+            {result.riskCategory} RISK
+          </div>
+        </div>
+      </div>
+      <div className="mt-4 pt-4 border-t border-white/20 grid grid-cols-4 gap-4">
+        {[
+          { label: 'Rules Evaluated', value: result.totalRulesEvaluated },
+          { label: 'Rules Matched', value: result.rulesPassed },
+          { label: 'Not Matched', value: result.rulesFailed },
+          { label: 'Deviations', value: result.deviationsCount },
+        ].map(({ label, value }) => (
+          <div key={label} className="text-center">
+            <div className="text-2xl font-bold">{value}</div>
+            <div className="text-white/60 text-xs">{label}</div>
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}

TenantMiddleware.cs

@@ -0,0 +1,148 @@
+using Microsoft.EntityFrameworkCore;
+using OptimAI.BRE.RuleEngine.Api;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+
+namespace OptimAI.BRE.RuleEngine.Infrastructure;
+
+/// <summary>
+/// Resolves tenant from JWT claims (X-Tenant-ID header fallback).
+/// Every request must carry a valid tenant context.
+/// </summary>
+public sealed class TenantResolutionMiddleware : IMiddleware
+{
+    public async Task InvokeAsync(HttpContext ctx, RequestDelegate next)
+    {
+        // Skip for health checks and swagger
+        if (ctx.Request.Path.StartsWithSegments("/health") ||
+            ctx.Request.Path.StartsWithSegments("/swagger"))
+        {
+            await next(ctx);
+            return;
+        }
+
+        var tenantId = ResolveTenantId(ctx);
+        if (tenantId == null && !IsPublicEndpoint(ctx.Request.Path))
+        {
+            ctx.Response.StatusCode = 400;
+            await ctx.Response.WriteAsJsonAsync(new { error = "Tenant context missing" });
+            return;
+        }
+
+        if (tenantId != null)
+            ctx.Items["TenantId"] = tenantId;
+
+        await next(ctx);
+    }
+
+    private static Guid? ResolveTenantId(HttpContext ctx)
+    {
+        // 1. From JWT claim
+        var tenantClaim = ctx.User.FindFirst("tenant_id")?.Value;
+        if (tenantClaim != null && Guid.TryParse(tenantClaim, out var tid)) return tid;
+
+        // 2. From header (API key auth)
+        var header = ctx.Request.Headers["X-Tenant-ID"].FirstOrDefault();
+        if (header != null && Guid.TryParse(header, out var hid)) return hid;
+
+        return null;
+    }
+
+    private static bool IsPublicEndpoint(PathString path) =>
+        path.StartsWithSegments("/api/v1/auth");
+}
+
+/// <summary>
+/// API Key authentication middleware. Validates X-API-Key header.
+/// Populates tenant context and user claims from API key.
+/// </summary>
+public sealed class ApiKeyMiddleware : IMiddleware
+{
+    private readonly BREDbContext _db;
+
+    public ApiKeyMiddleware(BREDbContext db) => _db = db;
+
+    public async Task InvokeAsync(HttpContext ctx, RequestDelegate next)
+    {
+        var apiKey = ctx.Request.Headers["X-API-Key"].FirstOrDefault();
+
+        if (apiKey != null && !ctx.User.Identity?.IsAuthenticated == true)
+        {
+            var prefix = apiKey.Length >= 12 ? apiKey[..12] : apiKey;
+            var keyHash = HashApiKey(apiKey);
+
+            var key = await _db.ApiKeys
+                .FirstOrDefaultAsync(k =>
+                    k.ApiKeyPrefix == prefix &&
+                    k.ApiKeyHash == keyHash &&
+                    k.IsActive &&
+                    (k.ExpiresAt == null || k.ExpiresAt > DateTime.UtcNow));
+
+            if (key != null)
+            {
+                await _db.ApiKeys
+                    .Where(k => k.Id == key.Id)
+                    .ExecuteUpdateAsync(s => s.SetProperty(k => k.LastUsedAt, DateTime.UtcNow));
+
+                var claims = new List<Claim>
+                {
+                    new(ClaimTypes.NameIdentifier, key.Id.ToString()),
+                    new("tenant_id", key.TenantId.ToString()),
+                    new("auth_type", "api_key"),
+                    new("api_key_id", key.Id.ToString()),
+                };
+
+                foreach (var scope in key.Scopes)
+                    claims.Add(new Claim("permission", scope));
+
+                var identity = new ClaimsIdentity(claims, "ApiKey");
+                ctx.User = new ClaimsPrincipal(identity);
+                ctx.Items["TenantId"] = key.TenantId;
+            }
+        }
+
+        await next(ctx);
+    }
+
+    private static string HashApiKey(string key)
+    {
+        using var sha = System.Security.Cryptography.SHA256.Create();
+        var bytes = System.Text.Encoding.UTF8.GetBytes(key);
+        return Convert.ToHexString(sha.ComputeHash(bytes)).ToLower();
+    }
+}
+
+/// <summary>
+/// HttpContext-scoped tenant and user context accessor.
+/// </summary>
+public sealed class TenantContextAccessor : ITenantContextAccessor
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public TenantContextAccessor(IHttpContextAccessor httpContextAccessor)
+        => _httpContextAccessor = httpContextAccessor;
+
+    public Guid TenantId
+    {
+        get
+        {
+            var ctx = _httpContextAccessor.HttpContext;
+            if (ctx?.Items["TenantId"] is Guid id) return id;
+
+            var claim = ctx?.User.FindFirst("tenant_id")?.Value;
+            return claim != null && Guid.TryParse(claim, out var tid) ? tid : Guid.Empty;
+        }
+    }
+
+    public Guid UserId
+    {
+        get
+        {
+            var claim = _httpContextAccessor.HttpContext?.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+            return claim != null && Guid.TryParse(claim, out var id) ? id : Guid.Empty;
+        }
+    }
+
+    public string? UserEmail =>
+        _httpContextAccessor.HttpContext?.User.FindFirst(ClaimTypes.Email)?.Value;
+}

api-client.ts

@@ -0,0 +1,61 @@
+import axios, { type AxiosInstance, type AxiosError } from 'axios'
+
+const BASE_URL = process.env.NEXT_PUBLIC_API_URL ?? 'http://localhost:5000/api/v1'
+
+function createApiClient(): AxiosInstance {
+  const client = axios.create({
+    baseURL: BASE_URL,
+    timeout: 30_000,
+    headers: { 'Content-Type': 'application/json' },
+  })
+
+  // Attach JWT token
+  client.interceptors.request.use((config) => {
+    const token = typeof window !== 'undefined' ? localStorage.getItem('bre_access_token') : null
+    if (token) config.headers.Authorization = `Bearer ${token}`
+    return config
+  })
+
+  // Handle 401 → refresh or redirect
+  client.interceptors.response.use(
+    (res) => res,
+    async (error: AxiosError) => {
+      if (error.response?.status === 401) {
+        const refreshToken = localStorage.getItem('bre_refresh_token')
+        if (refreshToken) {
+          try {
+            const { data } = await axios.post(`${BASE_URL}/auth/refresh`, { refreshToken })
+            localStorage.setItem('bre_access_token', data.accessToken)
+            error.config!.headers!.Authorization = `Bearer ${data.accessToken}`
+            return client.request(error.config!)
+          } catch {
+            localStorage.clear()
+            window.location.href = '/login'
+          }
+        }
+      }
+      return Promise.reject(error)
+    }
+  )
+
+  return client
+}
+
+const instance = createApiClient()
+
+export const apiClient = {
+  get: <T>(url: string, params?: object): Promise<T> =>
+    instance.get(url, { params }).then((r) => r.data),
+
+  post: <T>(url: string, data?: object): Promise<T> =>
+    instance.post(url, data).then((r) => r.data),
+
+  put: <T>(url: string, data?: object): Promise<T> =>
+    instance.put(url, data).then((r) => r.data),
+
+  patch: <T>(url: string, data?: object): Promise<T> =>
+    instance.patch(url, data).then((r) => r.data),
+
+  delete: <T>(url: string): Promise<T> =>
+    instance.delete(url).then((r) => r.data),
+}

appsettings.Development.json

@@ -0,0 +1,40 @@
+{
+  "ConnectionStrings": {
+    "PostgreSQL": "Host=localhost;Port=5432;Database=optimai_bre;Username=optimai;Password=dev_password;Include Error Detail=true",
+    "Redis": "localhost:6379"
+  },
+  "Jwt": {
+    "SecretKey": "DEV_SECRET_KEY_CHANGE_IN_PRODUCTION_MIN_32_CHARS",
+    "Issuer": "OptimAI.BRE",
+    "Audience": "OptimAI.BRE.Clients",
+    "AccessTokenExpiryMinutes": 480,
+    "RefreshTokenExpiryDays": 30
+  },
+  "AiOptions": {
+    "Endpoint": "",
+    "ApiKey": "",
+    "ModelName": "gpt-4o",
+    "UseAzureOpenAI": false
+  },
+  "AllowedOrigins": [
+    "http://localhost:3000",
+    "https://localhost:3000",
+    "http://localhost:3001"
+  ],
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Debug",
+      "Override": {
+        "Microsoft": "Information",
+        "Microsoft.EntityFrameworkCore.Database.Command": "Information",
+        "System": "Warning"
+      }
+    }
+  },
+  "RuleEngine": {
+    "MaxConcurrentExecutions": 10,
+    "DefaultTimeoutMs": 30000,
+    "EnableAiByDefault": false,
+    "CacheRulesTtlMinutes": 1
+  }
+}

appsettings.Production.json

@@ -0,0 +1,39 @@
+{
+  "ConnectionStrings": {
+    "PostgreSQL": "Host=bre-postgres;Port=5432;Database=optimai_bre;Username=optimai;Password=PLACEHOLDER_OVERRIDDEN_BY_ENV;Pooling=true;Minimum Pool Size=5;Maximum Pool Size=100;",
+    "Redis": "bre-redis:6379,password=PLACEHOLDER_OVERRIDDEN_BY_ENV,abortConnect=false"
+  },
+  "Jwt": {
+    "SecretKey": "PLACEHOLDER_OVERRIDDEN_BY_ENV",
+    "Issuer": "OptimAI.BRE",
+    "Audience": "OptimAI.BRE.Clients",
+    "AccessTokenExpiryMinutes": 480,
+    "RefreshTokenExpiryDays": 30
+  },
+  "AiOptions": {
+    "Endpoint": "",
+    "ApiKey": "",
+    "ModelName": "gpt-4o",
+    "UseAzureOpenAI": false
+  },
+  "AllowedOrigins": [
+    "http://localhost",
+    "https://localhost"
+  ],
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft": "Warning",
+        "Microsoft.EntityFrameworkCore": "Warning",
+        "System": "Warning"
+      }
+    }
+  },
+  "RuleEngine": {
+    "MaxConcurrentExecutions": 100,
+    "DefaultTimeoutMs": 5000,
+    "EnableAiByDefault": false,
+    "CacheRulesTtlMinutes": 5
+  }
+}

appsettings.json

@@ -0,0 +1,39 @@
+{
+  "ConnectionStrings": {
+    "PostgreSQL": "Host=localhost;Database=optimai_bre;Username=optimai;Password=dev_password",
+    "Redis": "localhost:6379"
+  },
+  "Jwt": {
+    "SecretKey": "DEV_SECRET_KEY_CHANGE_IN_PRODUCTION_MIN_32_CHARS",
+    "Issuer": "OptimAI.BRE",
+    "Audience": "OptimAI.BRE.Clients",
+    "AccessTokenExpiryMinutes": 60,
+    "RefreshTokenExpiryDays": 30
+  },
+  "AiOptions": {
+    "Endpoint": "",
+    "ApiKey": "",
+    "ModelName": "gpt-4o",
+    "UseAzureOpenAI": true
+  },
+  "AllowedOrigins": [
+    "http://localhost:3000",
+    "https://localhost:3000"
+  ],
+  "Serilog": {
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft": "Warning",
+        "Microsoft.EntityFrameworkCore": "Warning",
+        "System": "Warning"
+      }
+    }
+  },
+  "RuleEngine": {
+    "MaxConcurrentExecutions": 100,
+    "DefaultTimeoutMs": 5000,
+    "EnableAiByDefault": true,
+    "CacheRulesTtlMinutes": 5
+  }
+}

deployment.yaml

@@ -0,0 +1,481 @@
+---
+# ============================================================
+# OPTIM AI BRE Engine - Kubernetes Manifests
+# Production-grade deployment with HPA, PodDisruptionBudget
+# ============================================================
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: optimai-bre
+  labels:
+    app.kubernetes.io/name: optimai-bre
+    environment: production
+
+---
+# ============================================================
+# CONFIGMAP
+# ============================================================
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bre-config
+  namespace: optimai-bre
+data:
+  ASPNETCORE_ENVIRONMENT: "Production"
+  ASPNETCORE_URLS: "http://+:8080"
+  AiOptions__UseAzureOpenAI: "true"
+  AiOptions__ModelName: "gpt-4o"
+  Serilog__MinimumLevel__Default: "Information"
+
+---
+# ============================================================
+# SECRETS (use Sealed Secrets or Azure Key Vault in prod)
+# ============================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bre-secrets
+  namespace: optimai-bre
+type: Opaque
+stringData:
+  postgres-connection: "Host=postgres-service;Database=optimai_bre;Username=optimai;Password=CHANGE_ME"
+  redis-connection: "redis-service:6379,password=CHANGE_ME"
+  jwt-secret-key: "CHANGE_ME_TO_STRONG_RANDOM_KEY_MIN_32_CHARS"
+  azure-openai-endpoint: "https://your-resource.openai.azure.com/"
+  azure-openai-key: "CHANGE_ME"
+
+---
+# ============================================================
+# BRE GATEWAY DEPLOYMENT
+# ============================================================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bre-gateway
+  namespace: optimai-bre
+  labels:
+    app: bre-gateway
+    version: "1.0.0"
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: bre-gateway
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app: bre-gateway
+        version: "1.0.0"
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+        prometheus.io/path: "/metrics"
+    spec:
+      terminationGracePeriodSeconds: 30
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - bre-gateway
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: bre-gateway
+          image: optimai/bre-gateway:1.0.0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: ConnectionStrings__PostgreSQL
+              valueFrom:
+                secretKeyRef:
+                  name: bre-secrets
+                  key: postgres-connection
+            - name: ConnectionStrings__Redis
+              valueFrom:
+                secretKeyRef:
+                  name: bre-secrets
+                  key: redis-connection
+            - name: Jwt__SecretKey
+              valueFrom:
+                secretKeyRef:
+                  name: bre-secrets
+                  key: jwt-secret-key
+            - name: AiOptions__Endpoint
+              valueFrom:
+                secretKeyRef:
+                  name: bre-secrets
+                  key: azure-openai-endpoint
+            - name: AiOptions__ApiKey
+              valueFrom:
+                secretKeyRef:
+                  name: bre-secrets
+                  key: azure-openai-key
+          envFrom:
+            - configMapRef:
+                name: bre-config
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "1000m"
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: 8080
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep 5"]
+          volumeMounts:
+            - name: logs
+              mountPath: /app/logs
+      volumes:
+        - name: logs
+          emptyDir: {}
+
+---
+# ============================================================
+# BRE GATEWAY SERVICE
+# ============================================================
+apiVersion: v1
+kind: Service
+metadata:
+  name: bre-gateway-service
+  namespace: optimai-bre
+  labels:
+    app: bre-gateway
+spec:
+  type: ClusterIP
+  selector:
+    app: bre-gateway
+  ports:
+    - port: 80
+      targetPort: 8080
+      name: http
+
+---
+# ============================================================
+# HORIZONTAL POD AUTOSCALER
+# ============================================================
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: bre-gateway-hpa
+  namespace: optimai-bre
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: bre-gateway
+  minReplicas: 3
+  maxReplicas: 20
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: 80
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 60
+      policies:
+        - type: Pods
+          value: 2
+          periodSeconds: 60
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Pods
+          value: 1
+          periodSeconds: 120
+
+---
+# ============================================================
+# POD DISRUPTION BUDGET
+# ============================================================
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: bre-gateway-pdb
+  namespace: optimai-bre
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: bre-gateway
+
+---
+# ============================================================
+# FRONTEND DEPLOYMENT
+# ============================================================
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bre-frontend
+  namespace: optimai-bre
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: bre-frontend
+  template:
+    metadata:
+      labels:
+        app: bre-frontend
+    spec:
+      containers:
+        - name: bre-frontend
+          image: optimai/bre-frontend:1.0.0
+          ports:
+            - containerPort: 3000
+          env:
+            - name: NEXT_PUBLIC_API_URL
+              value: "https://api.optimaibre.com/api/v1"
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 3000
+            initialDelaySeconds: 15
+            periodSeconds: 10
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bre-frontend-service
+  namespace: optimai-bre
+spec:
+  type: ClusterIP
+  selector:
+    app: bre-frontend
+  ports:
+    - port: 80
+      targetPort: 3000
+
+---
+# ============================================================
+# INGRESS (NGINX / Azure Application Gateway)
+# ============================================================
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: bre-ingress
+  namespace: optimai-bre
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
+    nginx.ingress.kubernetes.io/rate-limit: "1000"
+    nginx.ingress.kubernetes.io/rate-limit-window: "1m"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  tls:
+    - hosts:
+        - api.optimaibre.com
+        - app.optimaibre.com
+      secretName: bre-tls-secret
+  rules:
+    - host: api.optimaibre.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: bre-gateway-service
+                port:
+                  number: 80
+    - host: app.optimaibre.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: bre-frontend-service
+                port:
+                  number: 80
+
+---
+# ============================================================
+# POSTGRESQL StatefulSet
+# ============================================================
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: optimai-bre
+spec:
+  serviceName: postgres-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:15-alpine
+          env:
+            - name: POSTGRES_DB
+              value: optimai_bre
+            - name: POSTGRES_USER
+              value: optimai
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: bre-secrets
+                  key: postgres-password
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - containerPort: 5432
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              memory: "2Gi"
+              cpu: "2000m"
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "optimai", "-d", "optimai_bre"]
+            initialDelaySeconds: 10
+            periodSeconds: 5
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: "managed-premium"
+        resources:
+          requests:
+            storage: 100Gi
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-service
+  namespace: optimai-bre
+spec:
+  clusterIP: None
+  selector:
+    app: postgres
+  ports:
+    - port: 5432
+
+---
+# ============================================================
+# REDIS StatefulSet
+# ============================================================
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: redis
+  namespace: optimai-bre
+spec:
+  serviceName: redis-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          command:
+            - redis-server
+            - --requirepass
+            - $(REDIS_PASSWORD)
+            - --maxmemory
+            - 512mb
+            - --maxmemory-policy
+            - allkeys-lru
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: bre-secrets
+                  key: redis-password
+          ports:
+            - containerPort: 6379
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+  volumeClaimTemplates:
+    - metadata:
+        name: redis-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 10Gi
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-service
+  namespace: optimai-bre
+spec:
+  clusterIP: None
+  selector:
+    app: redis
+  ports:
+    - port: 6379

docker-compose.yml

@@ -0,0 +1,335 @@
+# ==============================================================
+# OPTIM AI BRE Engine — Production Docker Compose
+# Single command deployment: docker compose up -d
+#
+# Architecture:
+#   nginx (port 80/443) → frontend (3000) + backend (8080)
+#   backend → postgres (5432) + redis (6379)
+#
+# All services run inside Docker. Nothing needs to be installed
+# on the host except Docker Desktop / Docker Engine.
+# ==============================================================
+
+name: optim-ai-bre
+
+# ==============================================================
+# NETWORKS
+# ==============================================================
+networks:
+  bre-public:
+    driver: bridge
+  bre-internal:
+    driver: bridge
+    internal: true
+
+# ==============================================================
+# PERSISTENT VOLUMES
+# ==============================================================
+volumes:
+  postgres-data:
+    driver: local
+    name: bre_postgres_data
+
+  redis-data:
+    driver: local
+    name: bre_redis_data
+
+  backend-logs:
+    driver: local
+    name: bre_backend_logs
+
+  backend-reports:
+    driver: local
+    name: bre_backend_reports
+
+  nginx-logs:
+    driver: local
+    name: bre_nginx_logs
+
+  db-backups:
+    driver: local
+    name: bre_db_backups
+
+# ==============================================================
+# SERVICES
+# ==============================================================
+services:
+
+  # ------------------------------------------------------------
+  # NGINX — Reverse Proxy & SSL Termination
+  # Entry point for all traffic on port 80 (and 443 for HTTPS)
+  # Routes: /api/* → backend | /* → frontend
+  # ------------------------------------------------------------
+  bre-nginx:
+    image: nginx:${NGINX_VERSION:-1.25-alpine}
+    container_name: bre-nginx
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./docker/nginx.conf:/etc/nginx/nginx.conf:ro
+      - nginx-logs:/var/log/nginx
+      # SSL certificates (optional — uncomment when you have certs):
+      # - ./docker/ssl:/etc/nginx/ssl:ro
+    networks:
+      - bre-public
+      - bre-internal
+    depends_on:
+      bre-backend:
+        condition: service_healthy
+      bre-frontend:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost/nginx-health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
+
+  # ------------------------------------------------------------
+  # BACKEND — .NET 8 BRE Engine API
+  # Internal only — not exposed to host, nginx proxies to it
+  # ------------------------------------------------------------
+  bre-backend:
+    build:
+      context: ./src/backend
+      dockerfile: ../../docker/Dockerfile.backend
+    image: optim-ai-bre/backend:latest
+    container_name: bre-backend
+    restart: unless-stopped
+    networks:
+      - bre-internal
+    environment:
+      ASPNETCORE_ENVIRONMENT: Production
+      ASPNETCORE_URLS: http://+:8080
+      DOTNET_RUNNING_IN_CONTAINER: "true"
+
+      # Database — reads from .env file
+      ConnectionStrings__PostgreSQL: >-
+        Host=bre-postgres;Port=5432;
+        Database=${POSTGRES_DB:-optimai_bre};
+        Username=${POSTGRES_USER:-optimai};
+        Password=${POSTGRES_PASSWORD};
+        Pooling=true;Minimum Pool Size=5;Maximum Pool Size=100;
+        Connection Lifetime=300;Keepalive=60
+      ConnectionStrings__Redis: >-
+        bre-redis:6379,
+        password=${REDIS_PASSWORD},
+        abortConnect=false,
+        connectRetry=3,
+        connectTimeout=5000,
+        syncTimeout=5000
+
+      # JWT
+      Jwt__SecretKey: ${JWT_SECRET_KEY}
+      Jwt__Issuer: ${JWT_ISSUER:-OptimAI.BRE}
+      Jwt__Audience: ${JWT_AUDIENCE:-OptimAI.BRE.Clients}
+      Jwt__AccessTokenExpiryMinutes: ${JWT_ACCESS_TOKEN_EXPIRY_MINUTES:-480}
+      Jwt__RefreshTokenExpiryDays: ${JWT_REFRESH_TOKEN_EXPIRY_DAYS:-30}
+
+      # AI Service
+      AiOptions__UseAzureOpenAI: ${USE_AZURE_OPENAI:-false}
+      AiOptions__Endpoint: ${AZURE_OPENAI_ENDPOINT:-}
+      AiOptions__ApiKey: ${AZURE_OPENAI_KEY:-}
+      AiOptions__ModelName: ${AZURE_OPENAI_MODEL:-gpt-4o}
+
+      # CORS
+      AllowedOrigins__0: ${APP_DOMAIN:-http://localhost}
+      AllowedOrigins__1: http://bre-frontend:3000
+
+      # Rule Engine
+      RuleEngine__MaxConcurrentExecutions: ${RULE_ENGINE_MAX_CONCURRENT:-100}
+      RuleEngine__DefaultTimeoutMs: ${RULE_ENGINE_TIMEOUT_MS:-5000}
+      RuleEngine__EnableAiByDefault: "false"
+      RuleEngine__CacheRulesTtlMinutes: ${RULE_ENGINE_CACHE_TTL_MINUTES:-5}
+
+      # Serilog
+      Serilog__MinimumLevel__Default: ${LOG_LEVEL:-Information}
+
+    volumes:
+      - backend-logs:/app/logs
+      - backend-reports:/app/reports
+    depends_on:
+      bre-postgres:
+        condition: service_healthy
+      bre-redis:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
+      interval: 30s
+      timeout: 15s
+      retries: 5
+      start_period: 60s
+    logging:
+      driver: json-file
+      options:
+        max-size: "20m"
+        max-file: "10"
+
+  # ------------------------------------------------------------
+  # FRONTEND — Next.js 14 UI
+  # Internal only — nginx proxies / to this service
+  # NEXT_PUBLIC_API_URL=/api/v1 → nginx routes to backend
+  # ------------------------------------------------------------
+  bre-frontend:
+    build:
+      context: ./src/frontend/optim-ai-bre-ui
+      dockerfile: ../../../docker/Dockerfile.frontend
+      args:
+        NEXT_PUBLIC_API_URL: /api/v1
+    image: optim-ai-bre/frontend:latest
+    container_name: bre-frontend
+    restart: unless-stopped
+    networks:
+      - bre-internal
+    environment:
+      NODE_ENV: production
+      NEXT_TELEMETRY_DISABLED: "1"
+      PORT: "3000"
+      HOSTNAME: "0.0.0.0"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
+
+  # ------------------------------------------------------------
+  # POSTGRESQL 15 — Primary Database
+  # Persistent volume: bre_postgres_data
+  # Init scripts auto-run on first empty volume start
+  # ------------------------------------------------------------
+  bre-postgres:
+    image: postgres:${POSTGRES_VERSION:-15-alpine}
+    container_name: bre-postgres
+    restart: unless-stopped
+    networks:
+      - bre-internal
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-optimai_bre}
+      POSTGRES_USER: ${POSTGRES_USER:-optimai}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=C --lc-ctype=C"
+      PGDATA: /var/lib/postgresql/data/pgdata
+    volumes:
+      # Persistent data volume
+      - postgres-data:/var/lib/postgresql/data
+      # Init scripts — run automatically on empty volume (first start)
+      - ./docker/postgres-init:/docker-entrypoint-initdb.d/init:ro
+      - ./database/migrations:/docker-entrypoint-initdb.d/migrations:ro
+      # Backup folder — mapped to host for easy backup access
+      - db-backups:/backups
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-optimai} -d ${POSTGRES_DB:-optimai_bre}"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+      start_period: 30s
+    command: >
+      postgres
+        -c max_connections=200
+        -c shared_buffers=256MB
+        -c effective_cache_size=768MB
+        -c maintenance_work_mem=64MB
+        -c checkpoint_completion_target=0.9
+        -c wal_buffers=16MB
+        -c default_statistics_target=100
+        -c random_page_cost=1.1
+        -c effective_io_concurrency=200
+        -c work_mem=4MB
+        -c min_wal_size=1GB
+        -c max_wal_size=4GB
+        -c log_min_duration_statement=1000
+        -c log_line_prefix='%t [%p] %u@%d '
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "5"
+
+  # ------------------------------------------------------------
+  # REDIS 7 — Rule Cache & Session Store
+  # Persistent volume: bre_redis_data
+  # Password-protected in production
+  # ------------------------------------------------------------
+  bre-redis:
+    image: redis:${REDIS_VERSION:-7-alpine}
+    container_name: bre-redis
+    restart: unless-stopped
+    networks:
+      - bre-internal
+    command: >
+      redis-server
+        --requirepass ${REDIS_PASSWORD}
+        --maxmemory 512mb
+        --maxmemory-policy allkeys-lru
+        --save 900 1
+        --save 300 10
+        --save 60 10000
+        --appendonly yes
+        --appendfsync everysec
+        --loglevel notice
+    volumes:
+      - redis-data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    logging:
+      driver: json-file
+      options:
+        max-size: "5m"
+        max-file: "3"
+
+  # ------------------------------------------------------------
+  # DB BACKUP — Scheduled PostgreSQL backup (runs daily at 2AM)
+  # Backups stored in the db-backups volume
+  # Keep 7 days of backups
+  # ------------------------------------------------------------
+  bre-db-backup:
+    image: postgres:${POSTGRES_VERSION:-15-alpine}
+    container_name: bre-db-backup
+    restart: unless-stopped
+    networks:
+      - bre-internal
+    environment:
+      PGPASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB:-optimai_bre}
+      POSTGRES_USER: ${POSTGRES_USER:-optimai}
+    volumes:
+      - db-backups:/backups
+    entrypoint: >
+      sh -c '
+        while true; do
+          TIMESTAMP=$$(date +%Y%m%d_%H%M%S)
+          BACKUP_FILE="/backups/bre_backup_$$TIMESTAMP.sql.gz"
+          echo "[$$TIMESTAMP] Starting database backup..."
+          pg_dump -h bre-postgres -U $$POSTGRES_USER -d $$POSTGRES_DB | gzip > $$BACKUP_FILE
+          echo "[$$TIMESTAMP] Backup saved: $$BACKUP_FILE"
+          # Delete backups older than 7 days
+          find /backups -name "bre_backup_*.sql.gz" -mtime +7 -delete
+          echo "[$$TIMESTAMP] Old backups cleaned. Sleeping 24h..."
+          sleep 86400
+        done
+      '
+    depends_on:
+      bre-postgres:
+        condition: service_healthy
+    logging:
+      driver: json-file
+      options:
+        max-size: "5m"
+        max-file: "3"

globals.css

@@ -0,0 +1,68 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+@layer base {
+  :root {
+    --background: 0 0% 100%;
+    --foreground: 222.2 84% 4.9%;
+  }
+
+  * {
+    box-sizing: border-box;
+  }
+
+  html {
+    scroll-behavior: smooth;
+  }
+
+  body {
+    @apply text-gray-900 antialiased;
+  }
+
+  /* Custom scrollbar */
+  ::-webkit-scrollbar {
+    width: 6px;
+    height: 6px;
+  }
+  ::-webkit-scrollbar-track {
+    @apply bg-gray-100;
+  }
+  ::-webkit-scrollbar-thumb {
+    @apply bg-gray-300 rounded-full;
+  }
+  ::-webkit-scrollbar-thumb:hover {
+    @apply bg-gray-400;
+  }
+}
+
+@layer components {
+  .card {
+    @apply bg-white rounded-xl border border-gray-200 shadow-sm;
+  }
+
+  .badge-green  { @apply inline-flex px-2.5 py-0.5 rounded-full text-xs font-semibold bg-emerald-100 text-emerald-700; }
+  .badge-red    { @apply inline-flex px-2.5 py-0.5 rounded-full text-xs font-semibold bg-red-100 text-red-700; }
+  .badge-amber  { @apply inline-flex px-2.5 py-0.5 rounded-full text-xs font-semibold bg-amber-100 text-amber-700; }
+  .badge-blue   { @apply inline-flex px-2.5 py-0.5 rounded-full text-xs font-semibold bg-blue-100 text-blue-700; }
+  .badge-purple { @apply inline-flex px-2.5 py-0.5 rounded-full text-xs font-semibold bg-purple-100 text-purple-700; }
+
+  .btn-primary {
+    @apply px-4 py-2 bg-blue-600 text-white rounded-lg text-sm font-semibold
+           hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed;
+  }
+  .btn-secondary {
+    @apply px-4 py-2 border border-gray-200 text-gray-700 rounded-lg text-sm font-medium
+           hover:bg-gray-50 transition-colors;
+  }
+  .btn-danger {
+    @apply px-4 py-2 bg-red-600 text-white rounded-lg text-sm font-semibold
+           hover:bg-red-700 transition-colors;
+  }
+
+  .input {
+    @apply w-full border border-gray-200 rounded-lg px-3 py-2 text-sm
+           focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-transparent
+           placeholder:text-gray-400;
+  }
+}

index.ts

@@ -0,0 +1,269 @@
+// ============================================================
+// OPTIM AI BRE ENGINE - TypeScript Types
+// ============================================================
+
+export type Decision = 'APPROVE' | 'REJECT' | 'DEVIATION' | 'REFER' | 'PENDING'
+export type TrafficLight = 'GREEN' | 'AMBER' | 'RED'
+export type RiskCategory = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'
+export type RuleStatus = 'DRAFT' | 'PENDING_APPROVAL' | 'APPROVED' | 'PUBLISHED' | 'ARCHIVED'
+export type RuleType = 'ELIGIBILITY' | 'CREDIT' | 'BUREAU' | 'FI' | 'VALUATION' | 'FRAUD' | 'COMPLIANCE' | 'DEVIATION' | 'INCOME' | 'KYC' | 'VEHICLE' | 'GUARANTOR'
+export type LogicalOperator = 'AND' | 'OR' | 'NOT'
+export type ComparisonOperator = 'EQUALS' | 'NOT_EQUALS' | 'GREATER_THAN' | 'GREATER_THAN_OR_EQUAL' | 'LESS_THAN' | 'LESS_THAN_OR_EQUAL' | 'BETWEEN' | 'NOT_BETWEEN' | 'IN' | 'NOT_IN' | 'CONTAINS' | 'IS_NULL' | 'IS_NOT_NULL' | 'IS_TRUE' | 'IS_FALSE' | 'REGEX'
+export type ActionType = 'SET_DECISION' | 'SET_RISK' | 'SET_TRAFFIC_LIGHT' | 'ADD_DEVIATION' | 'SET_FIELD' | 'ADD_TAG' | 'SET_SCORE'
+export type Severity = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'
+export type ScopeType = 'PRODUCT' | 'BRANCH' | 'STAGE' | 'USER_ROLE' | 'GLOBAL'
+
+// ============================================================
+// RULE ENGINE
+// ============================================================
+
+export interface ConditionGroup {
+  id: string
+  operator: LogicalOperator
+  rules: ConditionNode[]
+}
+
+export interface ConditionNode {
+  id: string
+  isGroup: boolean
+  // Leaf condition
+  field?: string
+  operator?: ComparisonOperator
+  value?: string | number | boolean | string[]
+  value2?: string | number  // for BETWEEN
+  valueType?: 'LITERAL' | 'FIELD' | 'FUNCTION'
+  referenceField?: string
+  // Group
+  group?: ConditionGroup
+}
+
+export interface RuleAction {
+  id: string
+  type: ActionType
+  value?: string
+  field?: string
+  parameters?: Record<string, string>
+}
+
+export interface RuleDefinition {
+  conditions: ConditionGroup
+  actions: RuleAction[]
+  metadata?: {
+    executionOrder?: number
+    stopOnMatch?: boolean
+    errorHandling?: 'SKIP' | 'FAIL' | 'USE_DEFAULT'
+    notes?: string
+  }
+}
+
+export interface RuleScope {
+  scopeType: ScopeType
+  scopeValue: string
+  isExcluded: boolean
+}
+
+export interface RuleVersion {
+  id: string
+  versionNumber: number
+  versionLabel: string
+  ruleDefinition: RuleDefinition
+  status: RuleStatus
+  changeSummary?: string
+  isCurrent: boolean
+  createdAt: string
+  approvedAt?: string
+  publishedAt?: string
+}
+
+export interface Rule {
+  id: string
+  ruleCode: string
+  ruleName: string
+  description?: string
+  categoryId?: string
+  ruleType: RuleType
+  priority: number
+  isActive: boolean
+  isPublished: boolean
+  status: RuleStatus
+  tags: string[]
+  currentVersion?: RuleVersion
+  scopes: RuleScope[]
+  versionCount?: number
+  createdAt: string
+  updatedAt: string
+}
+
+export interface RuleCategory {
+  id: string
+  categoryCode: string
+  categoryName: string
+  description?: string
+  icon?: string
+  sortOrder: number
+  isActive: boolean
+}
+
+export interface FieldCatalogEntry {
+  fieldPath: string
+  displayName: string
+  dataType: 'NUMBER' | 'STRING' | 'BOOLEAN' | 'DATE' | 'ARRAY' | 'OBJECT'
+  category?: string
+  description?: string
+}
+
+// ============================================================
+// EXECUTION
+// ============================================================
+
+export interface BREDecisionResponse {
+  requestId: string
+  correlationId: string
+  applicationId?: string
+  decision: Decision
+  trafficLight: TrafficLight
+  riskScore: number
+  riskCategory: RiskCategory
+  totalRulesEvaluated: number
+  rulesPassed: number
+  rulesFailed: number
+  deviationsCount: number
+  executionMs: number
+  ruleResults: RuleResult[]
+  aiSummary?: string
+  aiAnalysis?: AiAnalysis
+  reportId?: string
+  generatedAt: string
+}
+
+export interface RuleResult {
+  ruleCode: string
+  ruleName: string
+  isMatched: boolean
+  actionsExecuted: string[]
+  executionMs: number
+}
+
+export interface AiAnalysis {
+  riskSummary: string
+  creditSummary: string
+  strengths: string[]
+  weaknesses: string[]
+  deviationsSummary: string
+  approvalRecommendation: string
+  rejectionReasons: string[]
+  additionalDocuments: string[]
+  underwritingNotes: string
+  confidenceScore: number
+}
+
+export interface Deviation {
+  deviationCode: string
+  deviationName: string
+  severity: Severity
+  reason: string
+  fieldPath?: string
+  actualValue?: string
+  expectedValue?: string
+  recommendedAction?: string
+  isOverridden: boolean
+}
+
+// ============================================================
+// DASHBOARD
+// ============================================================
+
+export interface DashboardStats {
+  totalRules: number
+  activeRules: number
+  publishedRules: number
+  draftRules: number
+  totalExecutions: number
+  todayExecutions: number
+  approvalRate: number
+  rejectionRate: number
+  deviationRate: number
+  avgRiskScore: number
+  avgExecutionMs: number
+}
+
+export interface RuleHitAnalysis {
+  ruleCode: string
+  ruleName: string
+  totalEvaluations: number
+  matchedCount: number
+  hitRate: number
+  avgExecutionMs: number
+}
+
+export interface ExecutionTrend {
+  date: string
+  totalExecutions: number
+  approved: number
+  rejected: number
+  deviations: number
+  avgRiskScore: number
+}
+
+export interface DeviationAnalysisSummary {
+  deviationCode: string
+  deviationName: string
+  severity: Severity
+  occurrenceCount: number
+  overrideCount: number
+  month: string
+}
+
+// ============================================================
+// CLIENT MANAGEMENT
+// ============================================================
+
+export interface Tenant {
+  id: string
+  tenantCode: string
+  tenantName: string
+  displayName?: string
+  logoUrl?: string
+  primaryColor: string
+  planType: 'STARTER' | 'PROFESSIONAL' | 'ENTERPRISE'
+  maxRules: number
+  maxExecutionsPerDay: number
+  isActive: boolean
+  subscriptionEndDate?: string
+  createdAt: string
+}
+
+export interface User {
+  id: string
+  tenantId: string
+  email: string
+  username: string
+  fullName: string
+  employeeId?: string
+  designation?: string
+  department?: string
+  mobile?: string
+  isActive: boolean
+  roles: string[]
+  lastLoginAt?: string
+  createdAt: string
+}
+
+// ============================================================
+// MISC
+// ============================================================
+
+export interface PagedResponse<T> {
+  items: T[]
+  totalCount: number
+  page: number
+  pageSize: number
+  totalPages: number
+}
+
+export interface ApiError {
+  status: number
+  title: string
+  detail?: string
+  errors?: Record<string, string[]>
+}

layout.tsx

@@ -0,0 +1,25 @@
+import type { Metadata } from 'next'
+import { Inter } from 'next/font/google'
+import './globals.css'
+import { Providers } from './providers'
+import { AppShell } from '@/components/layout/AppShell'
+
+const inter = Inter({ subsets: ['latin'] })
+
+export const metadata: Metadata = {
+  title: 'OPTIM AI BRE Engine',
+  description: 'Enterprise AI-Powered Business Rule Engine for Banks and NBFCs',
+  icons: { icon: '/favicon.ico' },
+}
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en" suppressHydrationWarning>
+      <body className={`${inter.className} antialiased bg-gray-50`}>
+        <Providers>
+          <AppShell>{children}</AppShell>
+        </Providers>
+      </body>
+    </html>
+  )
+}