Update release-plz GitHub workflow (#466)

- Disable publishing for `ensure_no_std` test crate
- Add write content permissions to release-plz job expliclity

Signed-off-by: Burak Varlı <burakvar@amazon.co.uk>

.devcontainer/devcontainer.json

@@ -4,11 +4,20 @@
 	"name": "Rust",
 	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
 	"image": "mcr.microsoft.com/devcontainers/rust:1-1-bullseye",
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"ms-dotnettools.csharp",
+				"ms-dotnettools.csdevkit"
+			]
+		}
+	},
 	"features": {
-		"ghcr.io/devcontainers/features/dotnet:2": {},
+		"ghcr.io/devcontainers/features/dotnet:2": {
+			"version": "8.0"
+		},
 		"ghcr.io/devcontainers/features/python:1": {}
 	}
-
 	// Use 'mounts' to make the cargo cache persistent in a Docker Volume.
 	// "mounts": [
 	// 	{

.github/workflows/pr-extensions.yml

@@ -0,0 +1,36 @@
+name: tests/release-extensions
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Build only std
+      run: cargo build -r --example regorus --no-default-features --features "std,rego-extensions"
+    - name: Doc Tests
+      run: cargo test -r --doc --features rego-extensions
+    - name: Run tests
+      run: cargo test -r --features rego-extensions
+    - name: Run example
+      run: cargo run --example regorus --features rego-extensions -- eval -d examples/server/allowed_server.rego -i examples/server/input.json data.example
+    - name: Run tests (ACI)
+      run: cargo test -r --test aci --features rego-extensions
+    - name: Run tests (KATA)
+      run: cargo test -r --test kata --features rego-extensions
+    - name: Run tests (OPA Conformance)
+      run: >-
+        cargo test -r --test opa --features opa-testutil,serde_json/arbitrary_precision,rego-extensions  -- $(tr '\n' ' ' < tests/opa.passing)

.github/workflows/pr.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 env:
   CARGO_TERM_COLOR: always
@@ -18,22 +21,29 @@ jobs:
     - uses: actions/checkout@v4
     - name: Format Check
       run: cargo fmt --check
+    - name: Fetch
+      run: cargo fetch
     - name: Build (all features)
-      run: cargo build -r --all-features
+      run: cargo build -r --all-features --frozen
     - name: Build
-      run: cargo build -r
+      run: cargo build -r --frozen
     - name: Test no_std
-      run: cargo test -r --no-default-features
+      run: cargo test -r --no-default-features --frozen
     - name: Build only std
-      run: cargo build -r --example regorus --no-default-features --features "std"
+      run: cargo build -r --example regorus --no-default-features --features "std" --frozen
     - name: Doc Tests
-      run: cargo test -r --doc
+      run: cargo test -r --doc --frozen
     - name: Run tests
-      run: cargo test -r
+      run: cargo test -r --frozen
+    - name: Run example
+      run: cargo run --example regorus --frozen -- eval -d examples/server/allowed_server.rego -i examples/server/input.json data.example
     - name: Run tests (ACI)
-      run: cargo test -r --test aci
+      run: cargo test -r --test aci --frozen
     - name: Run tests (KATA)
-      run: cargo test -r --test kata
+      run: cargo test -r --test kata --frozen
     - name: Run tests (OPA Conformance)
       run: >-
-        cargo test -r --test opa --features opa-testutil,serde_json/arbitrary_precision  -- $(tr '\n' ' ' < tests/opa.passing)
+        cargo test -r --test opa --frozen --features opa-testutil,serde_json/arbitrary_precision  -- $(tr '\n' ' ' < tests/opa.passing)
+    - name: Run tests (Azure Policy)
+      run: >-
+        cargo test --frozen --features azure_policy

.github/workflows/publish-java.yml

@@ -48,7 +48,8 @@ jobs:
           python-version: "3.11"
       - if: ${{ matrix.build_cmd == 'zigbuild' }}
         run: pip install cargo-zigbuild
-      - run: cargo ${{ matrix.build_cmd || 'build' }} --release --target ${{ matrix.target }}${{ matrix.glibc && format('.{0}', matrix.glibc) || '' }} --manifest-path ./bindings/java/Cargo.toml
+      - run: cargo fetch
+      - run: cargo ${{ matrix.build_cmd || 'build' }} --release --frozen --target ${{ matrix.target }}${{ matrix.glibc && format('.{0}', matrix.glibc) || '' }} --manifest-path ./bindings/java/Cargo.toml
       - run: mkdir -p native/${{ matrix.target }}
       - run: mv target/${{ matrix.target }}/release/*.${{ matrix.extension }} ./native/${{ matrix.target }}/
       - uses: actions/upload-artifact@v4

.github/workflows/publish-python.yml

@@ -22,11 +22,19 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: '3.10'
+
+      - name: Build Python extension
+        run: |
+          cargo fetch
+          cargo clippy --all-targets --no-deps -- -Dwarnings
+          cargo build --release --target ${{ matrix.target }} --frozen
+        working-directory: bindings/python
+
       - name: Build wheels
         uses: PyO3/maturin-action@63b75c597b83e247fbf4fb7719801cc4220ae9f3 # v1.43.0
         with:
           target: ${{ matrix.target }}
-          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          args: --release --out dist --manifest-path bindings/python/Cargo.toml --offline --strip
           sccache: 'true'
           manylinux: auto
       - name: Upload wheels
@@ -46,11 +54,19 @@ jobs:
         with:
           python-version: '3.10'
           architecture: ${{ matrix.target }}
+
+      - name: Build Python extension
+        run: |
+          cargo fetch
+          cargo clippy --all-targets --no-deps -- -Dwarnings
+          cargo build --release --target ${{ matrix.host.target }} --frozen
+        working-directory: bindings/python
+
       - name: Build wheels
         uses: PyO3/maturin-action@63b75c597b83e247fbf4fb7719801cc4220ae9f3 # v1.43.0
         with:
           target: ${{ matrix.target }}
-          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          args: --release --out dist --manifest-path bindings/python/Cargo.toml --frozen --strip
           sccache: 'true'
       - name: Upload wheels
         uses: actions/upload-artifact@v3
@@ -68,11 +84,19 @@ jobs:
       - uses: actions/setup-python@v4
         with:
           python-version: '3.10'
+
+      - name: Build Python extension
+        run: |
+          cargo fetch
+          cargo clippy --all-targets --no-deps -- -Dwarnings
+          cargo build --release --target ${{ matrix.host.target }} --frozen
+        working-directory: bindings/python
+
       - name: Build wheels
         uses: PyO3/maturin-action@63b75c597b83e247fbf4fb7719801cc4220ae9f3 # v1.43.0
         with:
           target: ${{ matrix.target }}
-          args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
+          args: --release --out dist --manifest-path bindings/python/Cargo.toml --offline --strip
           sccache: 'true'
       - name: Upload wheels
         uses: actions/upload-artifact@v3
@@ -80,27 +104,12 @@ jobs:
           name: wheels
           path: dist
 
-  sdist:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Build sdist
-        uses: PyO3/maturin-action@63b75c597b83e247fbf4fb7719801cc4220ae9f3 # v1.43.0
-        with:
-          command: sdist
-          args: --out dist --manifest-path bindings/python/Cargo.toml
-      - name: Upload sdist
-        uses: actions/upload-artifact@v3
-        with:
-          name: wheels
-          path: dist
-
   release:
     name: Release
     runs-on: ubuntu-latest
     # Commented out for initial release.
     # if: "startsWith(github.ref, 'refs/tags/')"
-    needs: [linux, windows, macos, sdist]
+    needs: [linux, windows, macos]
     steps:
       - uses: actions/download-artifact@v3
         with:

.github/workflows/release-plz.yml

@@ -10,6 +10,8 @@ jobs:
   release-plz:
     name: Release-plz
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -18,7 +20,7 @@ jobs:
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
       - name: Run release-plz
-        uses: MarcoIeni/release-plz-action@98b2b45b090aadf18cb662caaf3de6222d98822a #v0.5.60
+        uses: MarcoIeni/release-plz-action@8724d33cd97b8295051102e2e19ca592962238f5 #v0.5.108
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/rust-clippy.yml

@@ -16,6 +16,9 @@ on:
     # The branches below must be a subset of the branches above
     branches: [ "main" ]
   workflow_dispatch:
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 jobs:
   rust-clippy-analyze:
@@ -40,11 +43,15 @@ jobs:
       - name: Install required cargo
         run: cargo install clippy-sarif sarif-fmt
 
+      - name: Fetch
+        run: cargo fetch
+
       - name: Run rust-clippy
         run:
           cargo clippy
           --all-features
           --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt
+          --frozen
         continue-on-error: true
 
       - name: Upload analysis results to GitHub

.github/workflows/test-c-cpp.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 jobs:
   test:
@@ -20,7 +23,8 @@ jobs:
 
       - name: Workaround to ensure that regorus.h is generated
         run: |
-          cargo build -r
+          cargo fetch
+          cargo build -r --frozen
         working-directory: ./bindings/ffi
         
       - name: Test c binding

.github/workflows/test-csharp.yml

@@ -1,14 +1,129 @@
 name: bindings/csharp
 
 on:
+  workflow_dispatch:
   push:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
-jobs:
-  test:
+env:
+  VersionSuffix: ${{ github.event_name == 'workflow_dispatch' && 'manualtrigger' || null }}
+
+jobs:  
+  build-ffi:
+    name: 'Build Regorus FFI: (${{ matrix.runtime.target }})'
+    runs-on: ${{ matrix.runtime.os }}
+    strategy:
+      # let us get failures from other jobs even if one fails
+      fail-fast: false
+      matrix:
+        runtime:
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            libpath: |
+              **/release/regorus_ffi.dll
+              **/release/regorus_ffi.pdb
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            libpath: |
+              **/release/libregorus_ffi.so
+          # Disabled for now
+          #- os: macos-latest
+          #  target: aarch64-apple-darwin
+          #  libpath: |
+          #    **/release/libregorus_ffi.dylib
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      
+      - name: Fetch crates
+        run: cargo fetch
+        working-directory: ./bindings/ffi
+
+      - name: Check Regorus binding formatting
+        run: cargo fmt --check
+        working-directory: ./bindings/ffi
+
+      - name: Check Clippy linting for Regorus binding
+        run: cargo clippy --frozen -- -D warnings
+        working-directory: ./bindings/ffi
+
+      - name: Build Regorus binding
+        run: cargo build -r --target ${{ matrix.runtime.target }} --locked
+        working-directory: ./bindings/ffi
+        
+      - name: Upload regorus ffi shared library
+        uses: actions/upload-artifact@v4
+        with:
+          name: regorus-ffi-artifacts-${{ matrix.runtime.target }}
+          # Note: The full path of each artifact relative to . is preserved.
+          path: ${{ matrix.runtime.libpath }}
+          if-no-files-found: error
+          retention-days: 1
+
+  build-nuget:
+    name: 'Build Regorus nuget'
     runs-on: ubuntu-latest
+    needs: build-ffi
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  
+      - uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: ./bindings/csharp/global.json
+
+      - run: echo '${{ steps.stepid.outputs.dotnet-version }}'
+
+      - name: Download regorus ffi shared libraries
+        uses: actions/download-artifact@v4
+        with:
+          pattern: regorus-ffi-artifacts-*
+          merge-multiple: true
+          path: ./bindings/csharp/Regorus/tmp
+
+      - name: Display regorus ffi artifacts
+        run: ls -R ./bindings/csharp/Regorus/tmp
+
+      # Note that we need to supply the target folder within the folder where artifacts are downloaded.
+      - name: Build Regorus binding
+        run: dotnet build /p:Configuration=Release /p:RegorusFFIArtifactsDir=./tmp/bindings/ffi/target
+        working-directory: ./bindings/csharp/Regorus
+
+      - name: Pack
+        run: dotnet pack /p:RegorusFFIArtifactsDir=./tmp/bindings/ffi/target
+        working-directory: ./bindings/csharp/Regorus
+
+      - name: Upload Regorus nuget
+        uses: actions/upload-artifact@v4
+        with:
+          name: regorus-nuget
+          path: bindings/csharp/Regorus/bin/Release/Regorus*.nupkg
+          if-no-files-found: error
+          retention-days: 1
+
+  test-nuget:
+    name: 'Test Regorus Nuget: (${{ matrix.runtime.target }})'
+    needs: build-nuget
+    runs-on: ${{ matrix.runtime.os }}
+    strategy:
+      # let us get failures from other jobs even if one fails
+      fail-fast: false
+      matrix:
+        runtime:
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          #- os: macos-latest
+          #  target: aarch64-apple-darwin
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -16,11 +131,47 @@ jobs:
           fetch-depth: 0
 
       - uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: ./bindings/csharp/global.json
 
-      - name: Build
-        run: dotnet build
-        working-directory: ./bindings/csharp
+      - run: echo '${{ steps.stepid.outputs.dotnet-version }}'
 
-      - name: Run
-        run: LD_LIBRARY_PATH=. dotnet run
-        working-directory: ./bindings/csharp
+      - name: Download regorus nuget
+        uses: actions/download-artifact@v4
+        with:
+          name: regorus-nuget
+          path: ./bindings/csharp/regorus-nuget/
+
+      - name: Restore Regorus.Tests
+        run: dotnet restore /p:RestoreAdditionalProjectSources=../regorus-nuget
+        working-directory: ./bindings/csharp/Regorus.Tests
+
+      - name: Run Regorus.Tests
+        run: dotnet test --no-restore
+        working-directory: ./bindings/csharp/Regorus.Tests
+
+      - name: Restore TestApp
+        run: dotnet restore /p:RestoreAdditionalProjectSources=../regorus-nuget
+        working-directory: ./bindings/csharp/TestApp
+
+      - name: Build TestApp
+        run: dotnet build --no-restore
+        working-directory: ./bindings/csharp/TestApp
+
+      - name: Run TestApp
+        run: dotnet run --no-build --framework net8.0
+        working-directory: ./bindings/csharp/TestApp
+
+      - name: Restore TargetExampleApp
+        run: dotnet restore /p:RestoreAdditionalProjectSources=../regorus-nuget
+        working-directory: ./bindings/csharp/TargetExampleApp
+
+      - name: Build TargetExampleApp
+        run: dotnet build --no-restore
+        working-directory: ./bindings/csharp/TargetExampleApp
+
+      - name: Run TargetExampleApp
+        run: dotnet run --no-build --framework net8.0
+        working-directory: ./bindings/csharp/TargetExampleApp
+
+      

.github/workflows/test-ffi.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 jobs:
   test:
@@ -17,6 +20,7 @@ jobs:
 
       - name: Test FFI
         run: |
-          cargo build -r
+          cargo fetch
+          cargo build -r --frozen
           cargo clippy --all-targets --no-deps -- -Dwarnings
         working-directory: ./bindings/ffi

.github/workflows/test-go.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 jobs:
   test:
@@ -18,7 +21,6 @@ jobs:
           
       - uses: actions/setup-go@v5
         with:
-          python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
 
       - name: Build ffi
@@ -29,5 +31,5 @@ jobs:
         run: |
           go mod tidy
           go build
-          LD_LIBRARY_PATH=../../target/release ./regorus_test
+          LD_LIBRARY_PATH=../ffi/target/release ./regorus_test
         working-directory: ./bindings/go

.github/workflows/test-java.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 jobs:
   test:
@@ -24,7 +27,7 @@ jobs:
       - name: Building binding
         run: |
           cargo clippy --all-targets --no-deps -- -Dwarnings
-          cargo build --release --manifest-path bindings/java/Cargo.toml
+          cargo build --release --manifest-path bindings/java/Cargo.toml --locked
 
       - name: Build jar
         run: mvn package
@@ -32,6 +35,6 @@ jobs:
 
       - name: Test jar
         run: |
-          javac -cp target/regorus-java-0.1.5.jar Test.java
-          java -Djava.library.path=../../target/release -cp target/regorus-java-0.1.5.jar:. Test
+          javac -cp target/regorus-java-0.2.2.jar Test.java
+          java -Djava.library.path=target/release -cp target/regorus-java-0.2.2.jar:. Test
         working-directory: ./bindings/java

.github/workflows/test-musl.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 env:
   CARGO_TERM_COLOR: always
@@ -20,14 +23,16 @@ jobs:
       run: rustup target add x86_64-unknown-linux-musl
     - name: Install musl-gcc
       run: sudo apt update && sudo apt install -y musl-tools
+    - name: Fetch
+      run: cargo fetch
     - name: Build (MUSL)
-      run: cargo build --verbose --all-targets --target x86_64-unknown-linux-musl
+      run: cargo build --verbose --all-targets --target x86_64-unknown-linux-musl --frozen
     - name: Run tests (MUSL)
-      run: cargo test -r --verbose --target x86_64-unknown-linux-musl
+      run: cargo test -r --verbose --target x86_64-unknown-linux-musl --frozen
     - name: Run tests (MUSL ACI)
-      run: cargo test -r --test aci --target x86_64-unknown-linux-musl
+      run: cargo test -r --test aci --target x86_64-unknown-linux-musl  --frozen
     - name: Run tests (KATA ACI)
-      run: cargo test -r --test kata --target x86_64-unknown-linux-musl
+      run: cargo test -r --test kata --target x86_64-unknown-linux-musl --frozen
     - name: Run tests (MUSL OPA Conformance)
       run: >-
-        cargo test -r --test opa --features opa-testutil,serde_json/arbitrary_precision --target x86_64-unknown-linux-musl  -- $(tr '\n' ' ' < tests/opa.passing)
+        cargo test -r --test opa --frozen --features opa-testutil,serde_json/arbitrary_precision --target x86_64-unknown-linux-musl  -- $(tr '\n' ' ' < tests/opa.passing)

.github/workflows/test-no-std.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 env:
   CARGO_TERM_COLOR: always
@@ -18,7 +21,9 @@ jobs:
     - uses: actions/checkout@v3
     - name: Add no_std target
       run: rustup target add thumbv7m-none-eabi
+    - name: Fetch
+      run: cargo fetch
     - name: Build
-      run: cargo build -r --target thumbv7m-none-eabi
+      run: cargo build -r --target thumbv7m-none-eabi --frozen
       working-directory: ./tests/ensure_no_std
 

.github/workflows/test-python.yml

@@ -5,13 +5,23 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 env:
   PYTHON_VERSION: "3.10"
-    
+
 jobs:
-  test:
-    runs-on: ubuntu-latest
+  build:
+    strategy:
+      matrix:
+        host:
+          - name: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+          - name: windows-latest
+            target: x86_64-pc-windows-msvc
+    runs-on: ${{ matrix.host.name }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -23,16 +33,60 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
           architecture: x64
 
-      - name: Build wheels
+      - name: Build Python extension
+        run: |
+          cargo fetch
+          cargo clippy --all-targets --no-deps -- -Dwarnings
+          cargo build --release --target ${{ matrix.host.target }} --frozen
+        working-directory: bindings/python
+
+      - name: Build Wheel
         uses: PyO3/maturin-action@63b75c597b83e247fbf4fb7719801cc4220ae9f3 # v1.43.0
         with:
           target: x86_64
-          args: --release --out dist --manifest-path bindings/python/Cargo.toml
+          args: --release --out dist --manifest-path bindings/python/Cargo.toml --offline --strip
           sccache: 'true'
 
-      - name: Test wheel
+      - name: Upload Wheel
+        uses: actions/upload-artifact@v4
+        with:
+          name: regorus-wheel-${{ matrix.host.name }}
+          path: dist/regorus-*.whl
+
+  test:
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        host:
+          - name: ubuntu-24.04
+            wheel: regorus-0.5.0-cp310-abi3-manylinux_2_34_x86_64.whl
+          - name: ubuntu-22.04
+            wheel: regorus-0.5.0-cp310-abi3-manylinux_2_34_x86_64.whl
+          - name: windows-latest
+            wheel: regorus-0.5.0-cp310-abi3-win_amd64.whl
+
+    needs: build
+    runs-on: ${{ matrix.host.name }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download Regorus wheel
+        uses: actions/download-artifact@v4
+        with:
+          path: wheels
+          pattern: regorus-wheel-*
+          merge-multiple: true
+
+      - uses: actions/setup-python@v4
+        with:
+          python-version: ${{ matrix.python-version }}
+          architecture: x64
+
+      - name: Test Wheel
         run:  |
-          pip3 install dist/regorus-*.whl
-          cd bindings/python
-          cargo clippy --all-targets --no-deps -- -Dwarnings
-          python3 test.py          
+          pip3 install ../../wheels/${{ matrix.host.wheel }}
+          python3 test.py
+        working-directory: bindings/python

.github/workflows/test-ruby.yml

@@ -18,7 +18,9 @@ jobs:
       - name: Setup Ruby and Rust
         uses: oxidize-rb/actions/setup-ruby-and-rust@7ca44a16e287e5ff7dd72ab53f4bd41cbf34a571 #v1.26
         with:
-          ruby-version: "3.3.1"
+          bundler: 2.6.5
+          rubygems: 3.6.5
+          ruby-version: "3.4.2"
           rustup-toolchain: "stable"
           bundler-cache: true
           cargo-cache: true
@@ -27,5 +29,7 @@ jobs:
       - name: Run ruby tests
         run:  |
           cd bindings/ruby
+          gem install bundler
+          bundle install
           cargo clippy --all-targets --no-deps -- -Dwarnings
           bundle exec rake

.github/workflows/test-wasm.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 jobs:
   test:
@@ -26,7 +29,10 @@ jobs:
       - name: Test wasm binding
         run: |
           cd bindings/wasm
+          cargo fetch
           cargo clippy --all-targets --no-deps -- -Dwarnings
           wasm-pack build --target nodejs --release
-          wasm-pack test --release --node
+          # Enable when upstream issue is fixed.
+          # https://github.com/microsoft/regorus/issues/371
+          # wasm-pack test --release --node
           node test.js

.github/workflows/tests-debug.yml

@@ -5,6 +5,9 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+  schedule:
+    # Run at 8:00 AM every day
+    - cron: "0 8 * * *"
 
 env:
   CARGO_TERM_COLOR: always
@@ -16,22 +19,24 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+    - name: Fetch
+      run: cargo fetch
     - name: Build (all features)
-      run: cargo build --all-features
+      run: cargo build --all-features --frozen
     - name: Build
-      run: cargo build
+      run: cargo build --frozen
     - name: Test no_std
-      run: cargo test --no-default-features
+      run: cargo test --no-default-features --frozen
     - name: Build only std
-      run: cargo build --example regorus --no-default-features --features "std"
+      run: cargo build --example regorus --no-default-features --features "std" --frozen
     - name: Doc Tests
-      run: cargo test --doc
+      run: cargo test --doc --frozen
     - name: Run tests
-      run: cargo test
+      run: cargo test --frozen
     - name: Run tests (ACI)
-      run: cargo test --test aci
+      run: cargo test --test aci --frozen
     - name: Run tests (KATA)
-      run: cargo test --test kata
+      run: cargo test --test kata --frozen
     - name: Run tests (OPA Conformance)
       run: >-
-        cargo test --test opa --features opa-testutil,serde_json/arbitrary_precision  -- $(tr '\n' ' ' < tests/opa.passing)
+        cargo test --test opa --frozen --features opa-testutil,serde_json/arbitrary_precision  -- $(tr '\n' ' ' < tests/opa.passing)

.gitignore

@@ -1,10 +1,8 @@
 # Generated by Cargo
 # will have compiled files and executables
 /target/
-
-# Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
-# More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
-Cargo.lock
+**/wheels/
+**/__pycache__/
 
 # These are backup files generated by rustfmt
 **/*.rs.bk
@@ -23,4 +21,16 @@ worktrees/
 
 # Generated C, C++ headers
 bindings/ffi/regorus.h
-bindings/ffi/regorus.ffi.hpp
+bindings/ffi/regorus.ffi.hpp
+
+bindings/*/target
+
+# C# build folders
+**bin
+**obj
+
+# Visual Studio folders
+**/*.vs
+
+# Visual Studio solution files
+*.sln

CHANGELOG.md

@@ -6,6 +6,150 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0](https://github.com/microsoft/regorus/compare/regorus-v0.4.0...regorus-v0.5.0) - 2025-07-08
+
+### Added
+
+- [**breaking**] Indexes for nodes in the AST ([#414](https://github.com/anakrish/regorus/pull/414))
+- Updates for Policy Framework ([#405](https://github.com/anakrish/regorus/pull/405))
+- Regorus nuget package ([#383](https://github.com/anakrish/regorus/pull/383))
+
+### Fixed
+
+- emit import warning to stderr ([#430](https://github.com/anakrish/regorus/pull/430))
+- Clippy warnings ([#424](https://github.com/anakrish/regorus/pull/424))
+- Disallow else blocks for set rules ([#403](https://github.com/anakrish/regorus/pull/403))
+- [**breaking**] Remove cryptographic builtins ([#396](https://github.com/anakrish/regorus/pull/396))
+- [**breaking**] Fix glob.match behavior in presence of : ([#390](https://github.com/anakrish/regorus/pull/390))
+- C# EvalRule ([#387](https://github.com/anakrish/regorus/pull/387))
+
+### Other
+
+- Update release-plz action to v0.5.108 ([#431](https://github.com/anakrish/regorus/pull/431))
+- Early return for 'some in' statement ([#427](https://github.com/anakrish/regorus/pull/427))
+- Support manually generating C# bindings via Github action and add a README ([#423](https://github.com/anakrish/regorus/pull/423))
+- Make the bindings/cpp CMake project installable ([#416](https://github.com/anakrish/regorus/pull/416))
+- *(deps)* bump clap from 4.5.38 to 4.5.39 ([#415](https://github.com/anakrish/regorus/pull/415))
+- *(deps)* Update criterion and other deps ([#412](https://github.com/anakrish/regorus/pull/412))
+- Basic benchmarking setup with Criterion ([#408](https://github.com/anakrish/regorus/pull/408))
+- Default to Rego v1 in `regorus parse` ([#407](https://github.com/anakrish/regorus/pull/407))
+- *(deps)* bump clap from 4.5.37 to 4.5.38 ([#406](https://github.com/anakrish/regorus/pull/406))
+- Update dependencies ([#401](https://github.com/anakrish/regorus/pull/401))
+- Add C# test examples ([#397](https://github.com/anakrish/regorus/pull/397))
+- *(deps)* bump clap from 4.5.35 to 4.5.36 ([#395](https://github.com/anakrish/regorus/pull/395))
+- Python binding portability ([#388](https://github.com/anakrish/regorus/pull/388))
+- *(deps)* bump clap from 4.5.34 to 4.5.35 ([#389](https://github.com/anakrish/regorus/pull/389))
+- Use VersionPrefix and VersionSuffix ([#385](https://github.com/anakrish/regorus/pull/385))
+- Check-in Cargo.lock files and lockdown .net ([#384](https://github.com/anakrish/regorus/pull/384))
+
+## [0.4.0](https://github.com/microsoft/regorus/compare/regorus-v0.3.0...regorus-v0.4.0) - 2025-03-14
+
+### Fixed
+- [**breaking**] Update ruby json dependency ([#381](https://github.com/microsoft/regorus/pull/381))
+- [**breaking**] Remove ring dependency ([#380](https://github.com/microsoft/regorus/pull/380))
+- [**breaking**] Remove sha1 dependency ([#379](https://github.com/microsoft/regorus/pull/379))
+
+### Other
+- Specify optimization flags ([#378](https://github.com/microsoft/regorus/pull/378))
+
+## [0.3.0](https://github.com/microsoft/regorus/compare/regorus-v0.2.8...regorus-v0.3.0) - 2025-03-10
+
+### Added
+- [**breaking**] Update to OPA v1.2.0 ([#373](https://github.com/microsoft/regorus/pull/373))
+
+### Other
+- *(deps)* update pyo3 requirement from 0.23.5 to 0.24.0 ([#375](https://github.com/microsoft/regorus/pull/375))
+- Update ruby binding deps, ruby gem version 0.2.3 ([#374](https://github.com/microsoft/regorus/pull/374))
+- *(deps)* update pyo3 requirement from 0.22.0 to 0.23.5 ([#372](https://github.com/microsoft/regorus/pull/372))
+- *(deps)* update rand requirement from 0.8.5 to 0.9.0 ([#370](https://github.com/microsoft/regorus/pull/370))
+- *(deps)* update cbindgen requirement from 0.27.0 to 0.28.0 ([#361](https://github.com/microsoft/regorus/pull/361))
+- Fix typo in README.md ([#366](https://github.com/microsoft/regorus/pull/366))
+- Update dependencies ([#369](https://github.com/microsoft/regorus/pull/369))
+- Fix clippy warning for result? ([#362](https://github.com/microsoft/regorus/pull/362))
+- *(deps)* update itertools requirement from 0.13.0 to 0.14.0 ([#357](https://github.com/microsoft/regorus/pull/357))
+- *(deps)* update jsonschema requirement from 0.26.1 to 0.28.1 ([#356](https://github.com/microsoft/regorus/pull/356))
+- resolve anyhow compile errors ([#355](https://github.com/microsoft/regorus/pull/355))
+- *(deps)* update prettydiff requirement from 0.7.0 to 0.8.0 ([#348](https://github.com/microsoft/regorus/pull/348))
+
+## [0.2.8](https://github.com/microsoft/regorus/compare/regorus-v0.2.7...regorus-v0.2.8) - 2024-11-06
+
+### Other
+- *(deps)* update jsonschema requirement from 0.24.0 to 0.26.1 ([#343](https://github.com/microsoft/regorus/pull/343))
+- Update to OPA v0.70.0 ([#341](https://github.com/microsoft/regorus/pull/341))
+
+## [0.2.7](https://github.com/microsoft/regorus/compare/regorus-v0.2.6...regorus-v0.2.7) - 2024-10-22
+
+### Fixed
+- docs failing to build ([#334](https://github.com/microsoft/regorus/pull/334))
+
+### Other
+- *(deps)* update jsonschema requirement from 0.23.0 to 0.24.0 ([#332](https://github.com/microsoft/regorus/pull/332))
+- *(deps)* update jsonschema requirement from 0.22.3 to 0.23.0 ([#331](https://github.com/microsoft/regorus/pull/331))
+
+## [0.2.6](https://github.com/microsoft/regorus/compare/regorus-v0.2.5...regorus-v0.2.6) - 2024-10-09
+
+### Added
+- integer conversion functions for Value ([#328](https://github.com/microsoft/regorus/pull/328))
+
+### Other
+- update to OPA v0.69.0 ([#327](https://github.com/microsoft/regorus/pull/327))
+- *(deps)* update jsonschema requirement from 0.21.0 to 0.22.3 ([#326](https://github.com/microsoft/regorus/pull/326))
+- *(deps)* update jsonschema requirement from 0.20.0 to 0.21.0 ([#325](https://github.com/microsoft/regorus/pull/325))
+- update to jsonschema 0.20.0 ([#323](https://github.com/microsoft/regorus/pull/323))
+
+## [0.2.5](https://github.com/microsoft/regorus/compare/regorus-v0.2.4...regorus-v0.2.5) - 2024-09-18
+
+### Added
+- or keyword ([#315](https://github.com/microsoft/regorus/pull/315))
+
+### Fixed
+- Null terminate C# strings in Rust boundary ([#318](https://github.com/microsoft/regorus/pull/318))
+- Update readme with correct path to example policy ([#312](https://github.com/microsoft/regorus/pull/312))
+
+### Other
+- Update jsonschema requirement from 0.18.0 to 0.19.1 ([#317](https://github.com/microsoft/regorus/pull/317))
+- Update chrono-tz requirement from 0.8.5 to 0.10.0 ([#316](https://github.com/microsoft/regorus/pull/316))
+- Add tests for builtin strings::lower method ([#313](https://github.com/microsoft/regorus/pull/313))
+- Add tests for builtin strings::indexof method ([#311](https://github.com/microsoft/regorus/pull/311))
+
+## [0.2.4](https://github.com/microsoft/regorus/compare/regorus-v0.2.3...regorus-v0.2.4) - 2024-09-04
+
+### Added
+- OPA v0.68.0. Engine::set_rego_v1 ([#305](https://github.com/microsoft/regorus/pull/305))
+
+### Fixed
+- Handle parsing corner cases ([#309](https://github.com/microsoft/regorus/pull/309))
+- Propagate errors encountered in argument evaluation ([#308](https://github.com/microsoft/regorus/pull/308))
+- Issues [#302](https://github.com/microsoft/regorus/pull/302), [#303](https://github.com/microsoft/regorus/pull/303) ([#304](https://github.com/microsoft/regorus/pull/304))
+
+## [0.2.3](https://github.com/microsoft/regorus/compare/regorus-v0.2.2...regorus-v0.2.3) - 2024-08-16
+
+### Fixed
+- Match OPA behavior for split ([#295](https://github.com/microsoft/regorus/pull/295))
+- Merge data to init document ([#293](https://github.com/microsoft/regorus/pull/293))
+
+### Other
+- Update cbindgen requirement from 0.26.0 to 0.27.0 ([#296](https://github.com/microsoft/regorus/pull/296))
+- Bump rexml in /bindings/ruby in the bundler group across 1 directory ([#294](https://github.com/microsoft/regorus/pull/294))
+- Update csbindgen requirement from =1.9.0 to =1.9.3 ([#292](https://github.com/microsoft/regorus/pull/292))
+
+## [0.2.2](https://github.com/microsoft/regorus/compare/regorus-v0.2.1...regorus-v0.2.2) - 2024-07-28
+
+### Added
+- Update to opa v0.67.0 ([#286](https://github.com/microsoft/regorus/pull/286))
+
+### Fixed
+- Handle aliases in scheduler ([#285](https://github.com/microsoft/regorus/pull/285))
+
+### Other
+- Update readme ([#288](https://github.com/microsoft/regorus/pull/288))
+- Update binding versions ([#287](https://github.com/microsoft/regorus/pull/287))
+- build.rs create hooks dir if not exists ([#283](https://github.com/microsoft/regorus/pull/283))
+- add extension_list example ([#281](https://github.com/microsoft/regorus/pull/281))
+- Fix build break ([#278](https://github.com/microsoft/regorus/pull/278))
+- Update pyo3 requirement from 0.21.0 to 0.22.0 ([#275](https://github.com/microsoft/regorus/pull/275))
+- Update to OPA v0.66.0 ([#274](https://github.com/microsoft/regorus/pull/274))
+
 ## [0.2.1](https://github.com/microsoft/regorus/compare/regorus-v0.2.0...regorus-v0.2.1) - 2024-06-19
 
 ### Added
@@ -354,3 +498,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - LICENSE committed
 - CODE_OF_CONDUCT.md committed
 - Initial commit
+

Cargo.toml

@@ -1,20 +1,15 @@
 [workspace]
 
 members = [
-    "bindings/ffi",
-    "bindings/python",
-    "bindings/wasm",
-    "bindings/java",
-    "bindings/ruby/ext/regorusrb",
     "tests/ensure_no_std",
 ]
 
 [package]
 name = "regorus"
 description = "A fast, lightweight Rego (OPA policy language) interpreter"
-version = "0.2.1"
+version = "0.5.0"
 edition = "2021"
-license-file = "LICENSE"
+license = "MIT"
 repository = "https://github.com/microsoft/regorus"
 keywords = ["interpreter", "no_std", "opa", "policy-as-code", "rego"]
 
@@ -28,22 +23,21 @@ default = ["full-opa", "arc"]
 
 arc = ["scientific/arc"]
 ast = []
+azure_policy = ["dep:jsonschema", "arc", "dashmap"]
 base64 = ["dep:data-encoding"]
 base64url = ["dep:data-encoding"]
 coverage = []
-crypto = ["dep:constant_time_eq", "dep:hmac", "dep:hex", "dep:md-5", "dep:sha1", "dep:sha2"]
-deprecated = []
 hex = ["dep:data-encoding"]
 http = []
-glob = ["dep:wax"]
+glob = ["dep:globset"]
 graph = []
 jsonschema = ["dep:jsonschema"]
-jwt = ["dep:jsonwebtoken", "dep:data-encoding", "dep:itertools"]
+net = []
 no_std = ["lazy_static/spin_no_std"]
 opa-runtime = []
 regex = ["dep:regex"]
 semver = ["dep:semver"]
-std = ["rand/std", "rand/std_rng", "serde_json/std"]
+std = ["rand/std", "rand/std_rng", "serde_json/std", "msvc_spectre_libs" ]
 time = ["dep:chrono", "dep:chrono-tz"]
 uuid = ["dep:uuid"]
 urlquery = ["dep:url"]
@@ -52,14 +46,12 @@ full-opa = [
     "base64",
     "base64url",
     "coverage",
-    "crypto",
-    "deprecated",
     "glob",
     "graph",
     "hex",
     "http",
-    "jwt",
     "jsonschema",
+    "net",
     "opa-runtime",
     "regex",
     "semver",
@@ -67,7 +59,9 @@ full-opa = [
     "time",
     "uuid",
     "urlquery",
-    "yaml"
+    "yaml",
+
+    #"rego-extensions"
 ]
 
 # Features that can be used in no_std environments.
@@ -77,8 +71,6 @@ opa-no-std = [
   "base64",
   "base64url",
   "coverage",
-  "crypto",
-  "deprecated",
   "graph",
   "hex",
   "no_std",
@@ -89,6 +81,9 @@ opa-no-std = [
   "lazy_static/spin_no_std"
 ]
 
+# Rego language extensions
+rego-extensions = []
+
 # This feature enables some testing utils for OPA tests.
 opa-testutil = []
 rand = ["dep:rand"]
@@ -98,46 +93,47 @@ anyhow = { version = "1.0.45", default-features = false }
 serde = {version = "1.0.150", default-features = false, features = ["derive", "rc"] }
 serde_json = { version = "1.0.89", default-features = false, features = ["alloc"] }
 lazy_static =  { version = "1.4.0", default-features = false }
+thiserror = { version = "2.0", default-features = false }
 
-# Crypto
-constant_time_eq = {version = "0.3.0", optional = true, default-features = false }
-hmac = {version = "0.12.1", optional = true, default-features = false}
-sha2 = {version= "0.10.8", optional = true, default-features = false }
-hex = {version = "0.4.3", optional = true, default-features = false, features = ["alloc"] }
-sha1 = {version = "0.10.6", optional = true, default-features = false }
-md-5 = {version = "0.10.6", optional = true, default-features = false }
+data-encoding = { version = "2.8.0", optional = true, default-features=false, features = ["alloc"] }
+scientific = { version = "0.5.3" }
 
-data-encoding = { version = "2.4.0", optional = true, default-features=false, features = ["alloc"] }
-scientific = { version = "0.5.2" }
-
-regex = {version = "1.10.2", optional = true, default-features = false }
-semver = {version = "1.0.20", optional = true, default-features = false }
-wax = { version = "0.6.0", features = [], default-features = false, optional = true }
-url = { version = "2.5.0", optional = true }
-uuid = { version = "1.6.1", default-features = false, features = ["v4", "fast-rng"], optional = true }
-jsonschema = { version = "0.18.0", default-features = false, optional = true }
-chrono = { version = "0.4.31", optional = true }
-chrono-tz = { version = "0.8.5", optional = true }
-jsonwebtoken = { version = "9.2.0", optional = true }
-itertools = { version = "0.13.0", default-features = false, optional = true }
+globset = { version = "0.4.16", features = ["simd-accel"], default-features = false, optional = true }
+regex = {version = "1.11.1", optional = true, default-features = false }
+semver = {version = "1.0.25", optional = true, default-features = false }
+url = { version = "2.5.4", optional = true }
+uuid = { version = "1.15.1", default-features = false, features = ["v4", "fast-rng"], optional = true }
+jsonschema = { version = "0.30.0", default-features = false, optional = true }
+chrono = { version = "0.4.40", optional = true }
+chrono-tz = { version = "0.10.1", optional = true }
 
 serde_yaml = {version = "0.9.16", default-features = false, optional = true }
-rand = { version = "0.8.5", default-features = false, optional = true }
+# Specify thread_rng for in order to use random_range
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng"], optional = true }
+
+# Causes the project to link with the Spectre-mitigated CRT and libs.
+msvc_spectre_libs = { version = "0.1", features = ["error"], optional = true }
+dashmap = { version = "6.1", default-features = false, optional = true }
 
 [dev-dependencies]
 anyhow = "1.0.45"
 cfg-if = "1.0.0"
-clap = { version = "4.4.7", features = ["derive"] }
-prettydiff = { version = "0.7.0", default-features = false }
+clap = { version = "4.5.45", features = ["derive"] }
+prettydiff = { version = "0.8.0", default-features = false }
 serde_yaml = "0.9.16"
 test-generator = "0.3.1"
 walkdir = "2.3.2"
+criterion = { version = "0.7" }
+
+num_cpus = "1.16"
 
 [build-dependencies]
 anyhow = "1.0"
 
 [profile.release]
 debug = true
+lto = true
+codegen-units = 1
 
 [[test]]
 name="opa"
@@ -155,6 +151,25 @@ name="kata"
 harness=false
 test=false
 
+[[bench]]
+name = "regorus_benchmark"
+harness = false
+
+[[bench]]
+name = "schema_validation_benchmark"
+harness = false
+required-features = ["azure_policy"]
+
+[[bench]]
+name = "engine_evaluation_benchmark"
+path = "benches/evaluation/engine_evaluation_benchmark.rs"
+harness = false
+
+[[bench]]
+name = "compiled_policy_evaluation_benchmark"
+path = "benches/evaluation/compiled_policy_evaluation_benchmark.rs"
+harness = false
+
 [[example]]
 name="regorus"
 harness=false

README.md

@@ -9,8 +9,8 @@
 Regorus is also
   - *cross-platform* - Written in platform-agnostic Rust.
   - *no_std compatible* - Regorus can be used in `no_std` environments too. Most of the builtins are supported.
-  - *current* - We strive to keep Regorus up to date with latest OPA release. Regorus supports `import rego.v1`.
-  - *compliant* - Regorus is mostly compliant with the latest [OPA release v0.64.0](https://github.com/open-policy-agent/opa/releases/tag/v0.64.0). See [OPA Conformance](#opa-conformance) for details. Note that while we behaviorally produce the same results, we don't yet support all the builtins.
+  - *current* - We strive to keep Regorus up to date with latest OPA release. Regorus defaults to `v1` of the Rego language.
+  - *compliant* - Regorus is mostly compliant with the latest [OPA release v1.2.0](https://github.com/open-policy-agent/opa/releases/tag/v1.2.0). See [OPA Conformance](#opa-conformance) for details. Note that while we behaviorally produce the same results, we don't yet support all the builtins.
   - *extensible* - Extend the Rego language by implementing custom stateful builtins in Rust.
     See [add_extension](https://github.com/microsoft/regorus/blob/fc68bf9c8bea36427dae9401a7d1f6ada771f7ab/src/engine.rs#L352).
     Support for extensibility using other languages coming soon.
@@ -32,7 +32,6 @@ fn main() -> anyhow::Result<()> {
     let policy = String::from(
         r#"
        package example
-       import rego.v1
 
        allow if {
           ## All actions are allowed for admins.
@@ -99,7 +98,7 @@ $ cargo build -r --example regorus --no-default-features; strip target/release/e
 -rwxr-xr-x  1 anand  staff   1.9M May 11 22:04 target/release/examples/regorus*
 ```
 
-Regorus passes the [OPA v0.64.0 test-suite](https://www.openpolicyagent.org/docs/latest/ir/#test-suite) barring a few
+Regorus passes the [OPA v1.2.0 test-suite](https://www.openpolicyagent.org/docs/latest/ir/#test-suite) barring a few
 builtins. See [OPA Conformance](#opa-conformance) below.
 
 ## Bindings
@@ -108,11 +107,11 @@ Regorus can be used from a variety of languages:
 
 - *C*: C binding is generated using [cbindgen](https://github.com/mozilla/cbindgen).
   [corrosion-rs](https://github.com/corrosion-rs/corrosion) can be used to seamlessly use Regorous
-   in your CMake based projects. See [bindings/c](https://github.com/microsoft/regorus/tree/main/bindings/c).
+  in your CMake based projects. See [bindings/c](https://github.com/microsoft/regorus/tree/main/bindings/c).
 - *C freestanding*: [bindings/c_no_std](https://github.com/microsoft/regorus/tree/main/bindings/c_no_std) shows how to use Regorus from C environments without a libc.
 - *C++*: C++ binding is generated using [cbindgen](https://github.com/mozilla/cbindgen).
   [corrosion-rs](https://github.com/corrosion-rs/corrosion) can be used to seamlessly use Regorous
-   in your CMake based projects. See [bindings/cpp](https://github.com/microsoft/regorus/tree/main/bindings/cpp).
+  in your CMake based projects. See [bindings/cpp](https://github.com/microsoft/regorus/tree/main/bindings/cpp).
 - *C#*: C# binding is generated using [csbindgen](https://github.com/Cysharp/csbindgen). See [bindings/csharp](https://github.com/microsoft/regorus/tree/main/bindings/csharp) for an example of how to build and use Regorus in your C# projects.
 - *Golang*: The C bindings are exposed to Golang via [CGo](https://pkg.go.dev/cmd/cgo). See [bindings/go](https://github.com/microsoft/regorus/tree/main/bindings/go) for an example of how to build and use Regorus in your Go projects.
 - *Python*: Python bindings are generated using [pyo3](https://github.com/PyO3/pyo3). Wheels are created using [maturin](https://github.com/PyO3/maturin). See [bindings/python](https://github.com/microsoft/regorus/tree/main/bindings/python).
@@ -146,6 +145,7 @@ $ regorus
 Usage: regorus <COMMAND>
 
 Commands:
+  ast    Parse a Rego policy and dump AST
   eval   Evaluate a Rego Query
   lex    Tokenize a Rego policy
   parse  Parse a Rego policy
@@ -184,11 +184,11 @@ This produces the following output
 }
 ```
 
-Next, evaluate a sample [policy](https://github.com/microsoft/regorus/blob/main/examples/example.rego) and [input](https://github.com/microsoft/regorus/blob/main/examples/input.json)
+Next, evaluate a sample [policy](https://github.com/microsoft/regorus/blob/main/examples/server/allowed_server.rego) and [input](https://github.com/microsoft/regorus/blob/main/examples/server/input.json)
 (borrowed from [Rego tutorial](https://www.openpolicyagent.org/docs/latest/#2-try-opa-eval)):
 
 ```bash
-$ regorus eval -d examples/example.rego -i examples/input.json data.example
+$ regorus eval -d examples/server/allowed_server.rego -i examples/server/input.json data.example
 ```
 
 Finally, evaluate real-world [policies](tests/aci/) used in Azure Container Instances (ACI)
@@ -204,7 +204,7 @@ Regorus allows determining which lines of a policy have been executed using the
 We can try it out using the `regorus` example program by passing in the `--coverage` flag.
 
 ```shell
-$ regorus eval -d examples/example.rego -i examples/input.json data.example --coverage
+$ regorus eval -d examples/server/allowed_server.rego -i examples/server/input.json data.example --coverage
 ```
 
 It produces the following coverage report which shows that all lines are executed except the line that sets `allow` to true.
@@ -276,7 +276,7 @@ Benchmark 1: opa eval -b tests/aci -d tests/aci/data.json -i tests/aci/input.jso
 ```
 ## OPA Conformance
 
-Regorus has been verified to be compliant with [OPA v0.64.0](https://github.com/open-policy-agent/opa/releases/tag/v0.64.0)
+Regorus has been verified to be compliant with [OPA v1.2.0](https://github.com/open-policy-agent/opa/releases/tag/v1.2.0)
 using a [test driver](https://github.com/microsoft/regorus/blob/main/tests/opa.rs) that loads and runs the OPA testsuite using Regorus, and verifies that expected outputs are produced.
 
 The test driver can be invoked by running:
@@ -288,19 +288,16 @@ $ cargo test -r --test opa --features opa-testutil,serde_json/arbitrary_precisio
 Currently, Regorus passes all the non-builtin specific tests.
 See [passing tests suites](https://github.com/microsoft/regorus/blob/main/tests/opa.passing).
 
-The following test suites don't pass fully due to mising builtins:
-- `cryptoparsersaprivatekeys`
-- `cryptox509parseandverifycertificates`
-- `cryptox509parsecertificaterequest`
-- `cryptox509parsecertificates`
-- `cryptox509parsekeypair`
-- `cryptox509parsersaprivatekey`
+The following test suites don't pass fully due to missing builtins:
 - `globsmatch`
 - `graphql`
 - `invalidkeyerror`
 - `jsonpatch`
+- `jwtbuiltins`
 - `jwtdecodeverify`
 - `jwtencodesign`
+- `jwtencodesignheadererrors`
+- `jwtencodesignpayloaderrors`
 - `jwtencodesignraw`
 - `jwtverifyhs256`
 - `jwtverifyhs384`
@@ -322,6 +319,7 @@ The following test suites don't pass fully due to mising builtins:
 
 They are captured in the following [github issues](https://github.com/microsoft/regorus/issues?q=is%3Aopen+is%3Aissue+label%3Alib).
 
+Cryptographic builtins are not supported by design. Users that need cryptographic builtins are encouraged to use [extensions](https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_extension).
 
 ### Grammar
 

benches/evaluation/README.md

@@ -0,0 +1,157 @@
+# Regorus Multi-Threaded Evaluation Benchmark
+
+A benchmark suite for measuring the multi-threaded performance of the Regorus policy evaluation engine.
+
+## Overview
+
+This benchmark evaluates the throughput and scalability of Regorus policy evaluation across different thread counts and configuration strategies. It measures performance variations between fresh and cloned engine instances, as well as fresh and cloned input data.
+
+## Features
+
+- **Multi-threaded evaluation** testing from 1 to `num_cpus * 2` threads
+- **Configurable engine strategies**: Fresh vs. cloned engine instances
+- **Configurable input strategies**: Fresh parsing vs. cloned input data
+- **Complex policy evaluation** using realistic RBAC and data sensitivity policies
+- **Criterion-based benchmarking** with statistical analysis
+- **Performance metrics** including throughput and timing
+
+## Benchmark Structure
+
+### Test Configurations
+
+The benchmark tests four different configuration combinations:
+
+1. **Cloned Engines + Cloned Inputs**: Pre-instantiated engines with pre-parsed input data
+2. **Cloned Engines + Fresh Inputs**: Pre-instantiated engines with fresh JSON parsing
+3. **Fresh Engines + Cloned Inputs**: New engine instances with pre-parsed input data
+4. **Fresh Engines + Fresh Inputs**: New engine instances with fresh JSON parsing
+
+### Thread Scaling
+
+Tests are performed with thread counts: 1, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24, 26, 28, 30, 32 (up to `num_cpus * 2`)
+
+Each thread performs 1000 policy evaluations to ensure statistically significant measurements.
+
+## Running the Benchmark
+
+### Prerequisites
+
+- Rust 1.70+
+- Cargo
+
+### Execution
+
+Run the complete benchmark suite:
+
+```bash
+cargo bench evaluation_benchmark
+```
+
+Run specific benchmarks:
+
+```bash
+# Run only cloned engines with cloned inputs
+cargo bench "cloned_engines , cloned_inputs"
+
+# Run only single-threaded tests
+cargo bench "1 threads"
+```
+
+### Output
+
+Results are generated in the `target/criterion/` directory and include:
+
+- Detailed timing statistics
+- Throughput measurements (Kelem/s)
+- Performance comparison with previous runs
+- HTML reports with graphs and analysis
+
+## Test Policies
+
+The benchmark uses complex Rego policies that simulate real-world scenarios:
+
+### RBAC Policy
+- Role-based access control with hierarchical permissions
+- User-role-resource mapping
+- Action-based authorization
+
+### Data Sensitivity Policy
+- Multi-level data classification (public, internal, confidential, secret)
+- Access level validation
+- Clearance-based filtering
+
+### Time-based Access Policy
+- Business hours validation
+- Temporal access control
+- Schedule-based permissions
+
+### Azure Resource Policies
+- **VM Deployment**: VM size restrictions, regional compliance, security configurations
+- **Storage Account Security**: Encryption requirements, network ACLs, HTTPS enforcement
+- **Key Vault Access**: Service principal validation, soft delete requirements, conditional access
+- **Network Security Groups**: Port restrictions, CIDR validation, priority-based rules
+
+### Policy Complexity Features
+- **Multi-condition validation**: Complex nested object property checks
+- **Network operations**: CIDR matching and IP range validation
+- **Time-based constraints**: Timestamp comparisons and business hour logic
+- **Security compliance**: Encryption, authentication, and access control patterns
+- **Azure Resource Manager**: Real-world cloud governance scenarios
+
+## Configuration
+
+### Benchmark Parameters
+
+- **Evaluations per thread**: 1000
+- **Measurement iterations**: 100 samples per configuration
+- **Warm-up time**: 3 seconds
+- **Measurement time**: 10 seconds (extended for high thread counts)
+
+### Customization
+
+The benchmark can be customized by modifying `evaluation_benchmark.rs`:
+
+```rust
+// Adjust evaluations per thread
+let evals_per_thread = 1000;
+
+// Modify thread count calculation
+let max_threads = num_cpus::get() * 2;
+
+// Configure test scenarios
+let scenarios = [
+    (true, true),   // cloned_engines, cloned_inputs
+    (true, false),  // cloned_engines, fresh_inputs
+    (false, true),  // fresh_engines, cloned_inputs
+    (false, false), // fresh_engines, fresh_inputs
+];
+```
+
+## Understanding Results
+
+### Metrics
+
+- **Total Evaluation Time**: Total execution time for all evaluations across all threads (ms)
+- **Throughput**: Evaluations per second measured in Kelem/s
+  - **Kelem/s**: Thousands of elements (policy evaluations) per second
+  - Example: 98.71 Kelem/s = 98,710 policy evaluations per second
+
+
+### Interpretation
+
+- **Lower time** = better performance
+- **Higher throughput** = better performance
+- **Consistent results** across runs indicate stable performance
+- **Outliers** may indicate system interference or measurement variance
+
+### Tips
+
+- Run on dedicated hardware for consistent results
+- Disable other applications during benchmarking
+- Use release builds for accurate performance measurements
+- Consider CPU affinity for highly controlled testing
+
+## Files
+
+- `evaluation_benchmark.rs`: Main benchmark implementation
+- Results are saved to `../../target/criterion/` directory

benches/evaluation/compiled_policy_evaluation_benchmark.md

@@ -0,0 +1,135 @@
+# Compiled Policy Evaluation Benchmark Results
+
+## Test Environment
+- **Platform**: Apple Silicon (M-Series)
+- **CPU**: 16 cores
+- **Architecture**: ARM64 (aarch64-apple-darwin)
+- **Rust Version**: 1.82.0
+- **Benchmark Framework**: Criterion.rs
+- **Test Data**: 20,000 inputs per evaluation (1000 per thread)
+- **Policy**: Complex authorization policy with nested rules
+
+## Benchmark Overview
+
+The compiled policy evaluation benchmark tests Regorus compiled policy performance across multiple thread configurations (1-32 threads). It measures throughput (thousands of evaluations per second) for different combinations of compiled policy and input data reuse strategies.
+
+## Configuration Combinations
+
+1. **Compiled Shared Policies, Cloned Inputs**: Each thread uses shared compiled policies and clones of parsed input data - optimal for performance
+2. **Compiled Shared Policies, Fresh Inputs**: Each thread uses shared compiled policies but parses new inputs each time
+3. **Compiled Per Iteration, Cloned Inputs**: Each thread compiles the policy each iteration but reuses input data
+4. **Compiled Per Iteration, Fresh Inputs**: Each thread compiles new policies and parses new inputs for each iteration
+
+## Performance Results
+
+### Compiled Shared Policies, Cloned Inputs (Best Performance)
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                       3.30 |                  303 |
+|       2 |                       8.53 |                  234 |
+|       4 |                      18.78 |                  213 |
+|       6 |                      32.35 |                  186 |
+|       8 |                      73.12 |                  109 |
+|      10 |                     108.97 |                   92 |
+|      12 |                     145.56 |                   82 |
+|      14 |                     196.14 |                   71 |
+|      16 |                     248.77 |                   64 |
+|      18 |                     290.01 |                   62 |
+|      20 |                     317.16 |                   63 |
+|      22 |                     348.83 |                   63 |
+|      24 |                     361.05 |                   66 |
+|      26 |                     389.70 |                   67 |
+|      28 |                     418.66 |                   67 |
+|      30 |                     444.40 |                   68 |
+|      32 |                     476.53 |                   67 |
+
+### Compiled Shared Policies, Fresh Inputs
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                       4.51 |                  222 |
+|       2 |                       9.77 |                  205 |
+|       4 |                      23.36 |                  171 |
+|       6 |                      38.12 |                  157 |
+|       8 |                      85.02 |                   94 |
+|      10 |                     133.66 |                   75 |
+|      12 |                     180.46 |                   66 |
+|      14 |                     238.23 |                   59 |
+|      16 |                     318.78 |                   50 |
+|      18 |                     353.15 |                   51 |
+|      20 |                     389.29 |                   51 |
+|      22 |                     459.61 |                   48 |
+|      24 |                     507.62 |                   47 |
+|      26 |                     539.43 |                   48 |
+|      28 |                     554.99 |                   50 |
+|      30 |                     625.57 |                   48 |
+|      32 |                     690.55 |                   46 |
+
+### Compiled Per Iteration, Cloned Inputs
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                      22.68 |                   44 |
+|       2 |                      47.99 |                   42 |
+|       4 |                     108.09 |                   37 |
+|       6 |                     167.62 |                   36 |
+|       8 |                     283.17 |                   28 |
+|      10 |                     418.25 |                   24 |
+|      12 |                     546.24 |                   22 |
+|      14 |                     688.79 |                   20 |
+|      16 |                     951.72 |                   17 |
+|      18 |                    1060.20 |                   17 |
+|      20 |                    1223.60 |                   16 |
+|      22 |                    1342.50 |                   16 |
+|      24 |                    1445.70 |                   17 |
+|      26 |                    1676.50 |                   15 |
+|      28 |                    1765.20 |                   16 |
+|      30 |                    1939.00 |                   15 |
+|      32 |                    2197.30 |                   15 |
+
+### Compiled Per Iteration, Fresh Inputs
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                      23.95 |                   42 |
+|       2 |                      49.53 |                   40 |
+|       4 |                     116.42 |                   34 |
+|       6 |                     197.35 |                   30 |
+|       8 |                     293.04 |                   27 |
+|      10 |                     385.90 |                   26 |
+|      12 |                     508.82 |                   24 |
+|      14 |                     679.23 |                   21 |
+|      16 |                     913.02 |                   18 |
+|      18 |                    1075.90 |                   17 |
+|      20 |                    1209.80 |                   17 |
+|      22 |                    1358.90 |                   16 |
+|      24 |                    1523.90 |                   16 |
+|      26 |                    1700.20 |                   15 |
+|      28 |                    1966.90 |                   14 |
+|      30 |                    2179.30 |                   14 |
+|      32 |                    2327.70 |                   14 |
+
+## Analysis
+
+The compiled policy benchmark demonstrates the following performance characteristics:
+
+1. **Best Performance**: Compiled shared policies with cloned inputs provide the highest throughput
+2. **Compilation Impact**: 
+   - Pre-compiled policies: Significantly faster than per-iteration compilation
+   - Per-iteration compilation: Major overhead (~7x slower than pre-compiled)
+3. **Scaling Patterns**:
+   - Best throughput achieved at 1 thread for shared policy configurations
+   - Higher thread counts show performance degradation due to contention
+   - Per-iteration compilation shows poor scaling across all thread counts
+4. **Input Processing**: Fresh inputs add ~25-30% overhead across all configurations
+5. **Thread Performance**: 
+   - Peak performance at 1 thread for most configurations
+   - Reasonable performance maintained up to 12-16 threads for shared policies
+   - Compiled policies show better thread scaling than per-iteration compilation
+
+## Comparison with Engine Evaluation
+
+| Configuration        | Compiled Policy (1 thread)      | Engine Evaluation (1 thread)    | Performance Ratio |
+|:---------------------|:--------------------------------|:--------------------------------|------------------:|
+| Shared/Cloned        | Best performance                | Higher throughput               |       0.67x-0.92x |
+| Shared/Fresh         | ~27% reduction from optimal     | ~30% reduction from optimal     |       0.62x-0.97x |
+| Per-iteration/Cloned | ~85% reduction from optimal     | ~86% reduction from optimal     |       0.80x-0.98x |
+| Per-iteration/Fresh  | ~86% reduction from optimal     | ~87% reduction from optimal     |       0.78x-1.00x |
+

benches/evaluation/compiled_policy_evaluation_benchmark.rs

@@ -0,0 +1,232 @@
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+use regorus::{compile_policy_with_entrypoint, CompiledPolicy, PolicyModule, Value};
+use std::collections::HashMap;
+use std::hint::black_box;
+use std::sync::{Arc, Barrier, Mutex};
+use std::thread;
+use std::time::Duration;
+
+mod policy_data;
+
+fn multi_threaded_compiled_eval(
+    num_threads: usize,
+    evals_per_thread: usize,
+    use_shared_policies: bool,
+    use_cloned_inputs: bool,
+) -> (std::time::Duration, HashMap<String, usize>, usize) {
+    // Complex policies with multiple valid inputs for each
+    let policies_with_inputs = policy_data::policies_with_inputs();
+
+    // Policy names for tracking
+    let policy_names = policy_data::policy_names()
+        .into_iter()
+        .map(|s| s.to_string())
+        .collect::<Vec<_>>();
+
+    // Pre-compile all policies and share them between threads (only if using shared policies)
+    let compiled_policies: Option<Arc<Vec<CompiledPolicy>>> = if use_shared_policies {
+        Some(Arc::new(
+            policies_with_inputs
+                .iter()
+                .map(|(policy, _)| {
+                    let module = PolicyModule {
+                        id: "policy.rego".into(),
+                        content: policy.as_str().into(),
+                    };
+                    compile_policy_with_entrypoint(
+                        Value::new_object(),
+                        &[module],
+                        "data.bench.allow".into(),
+                    )
+                    .unwrap()
+                })
+                .collect(),
+        ))
+    } else {
+        None
+    };
+
+    // Initialize policy evaluation counters
+    let policy_counters = Arc::new(Mutex::new(HashMap::new()));
+    for policy_name in &policy_names {
+        policy_counters
+            .lock()
+            .unwrap()
+            .insert(policy_name.to_string(), 0);
+    }
+    let total_evals = Arc::new(Mutex::new(0usize));
+
+    let barrier = Arc::new(Barrier::new(num_threads));
+    let mut handles = Vec::with_capacity(num_threads);
+
+    for thread_id in 0..num_threads {
+        let barrier = barrier.clone();
+        let policies_with_inputs = policies_with_inputs.clone();
+        let compiled_policies = compiled_policies.clone();
+        let policy_names = policy_names.clone();
+        let policy_counters = policy_counters.clone();
+        let total_evals = total_evals.clone();
+
+        handles.push(thread::spawn(move || {
+            let mut elapsed = std::time::Duration::ZERO;
+
+            // Pre-parse inputs if using cloned inputs
+            let parsed_inputs = if use_cloned_inputs {
+                Some(
+                    policies_with_inputs
+                        .iter()
+                        .map(|(_, inputs)| {
+                            inputs
+                                .iter()
+                                .map(|input_str| Value::from_json_str(input_str).unwrap())
+                                .collect::<Vec<_>>()
+                        })
+                        .collect::<Vec<_>>(),
+                )
+            } else {
+                None
+            };
+
+            barrier.wait();
+            for i in 0..evals_per_thread {
+                // Use different policy for each iteration - thread_id ensures different threads
+                // start with different policies for better load distribution
+                let policy_idx = (thread_id + i) % policies_with_inputs.len();
+                let (_, inputs) = &policies_with_inputs[policy_idx];
+
+                // Use different input for the same policy based on iteration - thread_id ensures
+                // different threads start with different inputs for better load distribution
+                let input_idx = (thread_id + i) % inputs.len();
+                let input = &inputs[input_idx];
+
+                let start = std::time::Instant::now();
+
+                let input_value = if use_cloned_inputs {
+                    parsed_inputs.as_ref().unwrap()[policy_idx][input_idx].clone()
+                } else {
+                    Value::from_json_str(input).unwrap()
+                };
+
+                let result = if let Some(ref compiled_policies_vec) = compiled_policies {
+                    // Use pre-compiled policy
+                    let compiled_policy = &compiled_policies_vec[policy_idx];
+                    compiled_policy.eval_with_input(input_value)
+                } else {
+                    // Compile policy in each iteration
+                    let (policy, _) = &policies_with_inputs[policy_idx];
+                    let module = PolicyModule {
+                        id: "policy.rego".into(),
+                        content: policy.as_str().into(),
+                    };
+                    let compiled_policy = compile_policy_with_entrypoint(
+                        Value::new_object(),
+                        &[module],
+                        "data.bench.allow".into(),
+                    )
+                    .unwrap();
+                    compiled_policy.eval_with_input(input_value)
+                };
+
+                elapsed += start.elapsed();
+
+                // Track total and successful evaluations
+                {
+                    let mut total = total_evals.lock().unwrap();
+                    *total += 1;
+                }
+                if result.is_ok() {
+                    if let Some(policy_name) = policy_names.get(policy_idx) {
+                        let mut counters = policy_counters.lock().unwrap();
+                        *counters.entry(policy_name.to_string()).or_insert(0) += 1;
+                    }
+                }
+            }
+            elapsed
+        }));
+    }
+
+    let mut total = std::time::Duration::ZERO;
+    for handle in handles {
+        total += handle.join().unwrap();
+    }
+
+    let final_counters = policy_counters.lock().unwrap().clone();
+    let total_evals = *total_evals.lock().unwrap();
+    (total, final_counters, total_evals)
+}
+
+fn criterion_benchmark(c: &mut Criterion) {
+    let max_threads = num_cpus::get() * 2;
+    println!(
+        "Running compiled policy benchmark with max_threads: {}",
+        max_threads
+    );
+
+    let evals_per_thread = 1000;
+
+    // Benchmark all combinations of compilation strategy and input strategy
+    for use_shared_policies in [true, false] {
+        for use_cloned_inputs in [true, false] {
+            let group_name = match (use_shared_policies, use_cloned_inputs) {
+                (true, true) => "compiled_shared_policies, cloned_inputs ",
+                (true, false) => "compiled_shared_policies, fresh_inputs  ",
+                (false, true) => "compiled_per_iteration , cloned_inputs ",
+                (false, false) => "compiled_per_iteration , fresh_inputs  ",
+            };
+
+            let mut group = c.benchmark_group(group_name);
+            group.measurement_time(Duration::from_secs(5));
+
+            // Test specific thread counts: powers of 2 + some intermediate values
+            let thread_counts: Vec<usize> = (1..=max_threads)
+                .filter(|&n| {
+                    n == 1 || // Always test single-threaded
+                    n % 2 == 0 || // Always test even threads
+                    n == max_threads // Maximum threads
+                })
+                .collect();
+
+            for threads in thread_counts {
+                let total_evals = threads * evals_per_thread;
+                group.throughput(Throughput::Elements(total_evals as u64));
+                group.bench_with_input(
+                    BenchmarkId::new("compiled_eval", format!(" {threads} threads")),
+                    &threads,
+                    |b, &threads| {
+                        b.iter_custom(|iters| {
+                            let evals_per_thread = evals_per_thread * (iters as usize);
+
+                            let (duration, policy_counters, total_evals_aggregated) = multi_threaded_compiled_eval(
+                                black_box(threads),
+                                black_box(evals_per_thread),
+                                black_box(use_shared_policies),
+                                black_box(use_cloned_inputs),
+                            );
+
+                            // Sanity check: Ensure the expected number of evaluations matches the actual number performed per iteration batch.
+                            // total_evals is the expected number for this batch, total_evals_aggregated is the sum over all iters.
+                            assert_eq!(total_evals, total_evals_aggregated/iters as usize);
+
+                            // On one iteration, print policy evaluation statistics
+                            if iters == 1 {
+                                // println!("\nCompiled Policy Evaluation Statistics:");
+                                for (policy_name, count) in &policy_counters {
+                                    // println!("  {}: {} evaluations", policy_name, count);
+                                    if *count == 0 {
+                                        println!("\x1b[31mERROR: Policy '{}' was never evaluated successfully!\x1b[0m", policy_name);
+                                    }
+                                }
+                            }
+
+                            duration
+                        });
+                    },
+                );
+            }
+            group.finish();
+        }
+    }
+}
+
+criterion_group!(benches, criterion_benchmark);
+criterion_main!(benches);

benches/evaluation/engine_evaluation_benchmark.md

@@ -0,0 +1,125 @@
+# Engine Evaluation Benchmark Results
+
+## Test Environment
+- **Platform**: Apple Silicon (M-Series)
+- **CPU**: 16 cores
+- **Architecture**: ARM64 (aarch64-apple-darwin)
+- **Rust Version**: 1.82.0
+- **Benchmark Framework**: Criterion.rs
+- **Test Data**: 20,000 inputs per evaluation (1000 per thread)
+- **Policy**: Complex authorization policy with nested rules
+
+## Benchmark Overview
+
+The engine evaluation benchmark tests Regorus policy evaluation performance across multiple thread configurations (1-32 threads). It measures throughput (thousands of evaluations per second) for different combinations of engine and input data reuse strategies.
+
+## Configuration Combinations
+
+1. **Cloned Engines, Cloned Inputs**: Each thread uses its own engine and clones of parsed input data - optimal for performance
+2. **Cloned Engines, Fresh Inputs**: Each thread uses its own engine but parses new inputs each time
+3. **Fresh Engines, Cloned Inputs**: Each thread creates a new engine each iteration but reuses input data
+4. **Fresh Engines, Fresh Inputs**: Each thread creates new engines and parses new inputs for each iteration
+
+## Performance Results
+
+### Cloned Engines, Cloned Inputs (Best Performance)
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                       3.05 |                  328 |
+|       2 |                       7.46 |                  268 |
+|       4 |                      16.10 |                  248 |
+|       6 |                      25.94 |                  231 |
+|       8 |                      50.18 |                  159 |
+|      10 |                      80.27 |                  125 |
+|      12 |                     106.31 |                  113 |
+|      14 |                     137.31 |                  102 |
+|      16 |                     163.91 |                   98 |
+|      18 |                     182.06 |                   99 |
+|      20 |                     191.36 |                  105 |
+|      22 |                     201.51 |                  109 |
+|      24 |                     217.65 |                  110 |
+|      26 |                     228.11 |                  114 |
+|      28 |                     248.17 |                  113 |
+|      30 |                     264.15 |                  114 |
+|      32 |                     314.27 |                  102 |
+
+### Cloned Engines, Fresh Inputs
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                       4.36 |                  229 |
+|       2 |                      10.34 |                  194 |
+|       4 |                      21.98 |                  182 |
+|       6 |                      34.05 |                  176 |
+|       8 |                      66.47 |                  120 |
+|      10 |                     100.78 |                   99 |
+|      12 |                     141.69 |                   85 |
+|      14 |                     188.53 |                   74 |
+|      16 |                     261.27 |                   61 |
+|      18 |                     285.29 |                   63 |
+|      20 |                     312.14 |                   64 |
+|      22 |                     329.42 |                   67 |
+|      24 |                     347.97 |                   69 |
+|      26 |                     370.24 |                   70 |
+|      28 |                     394.75 |                   71 |
+|      30 |                     419.30 |                   72 |
+|      32 |                     433.58 |                   74 |
+
+### Fresh Engines, Cloned Inputs
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                      22.39 |                   45 |
+|       2 |                      49.22 |                   41 |
+|       4 |                      98.09 |                   41 |
+|       6 |                     160.21 |                   37 |
+|       8 |                     281.26 |                   28 |
+|      10 |                     413.61 |                   24 |
+|      12 |                     578.15 |                   21 |
+|      14 |                     746.34 |                   19 |
+|      16 |                     961.44 |                   17 |
+|      18 |                    1127.70 |                   16 |
+|      20 |                    1248.40 |                   16 |
+|      22 |                    1386.90 |                   16 |
+|      24 |                    1559.70 |                   15 |
+|      26 |                    1736.30 |                   15 |
+|      28 |                    1891.80 |                   15 |
+|      30 |                    2077.00 |                   14 |
+|      32 |                    2289.30 |                   14 |
+
+### Fresh Engines, Fresh Inputs
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                      23.63 |                   42 |
+|       2 |                      48.82 |                   41 |
+|       4 |                     102.32 |                   39 |
+|       6 |                     160.09 |                   37 |
+|       8 |                     271.21 |                   29 |
+|      10 |                     397.39 |                   25 |
+|      12 |                     489.09 |                   25 |
+|      14 |                     670.33 |                   21 |
+|      16 |                     884.83 |                   18 |
+|      18 |                    1044.00 |                   17 |
+|      20 |                    1174.20 |                   17 |
+|      22 |                    1330.40 |                   17 |
+|      24 |                    1480.90 |                   16 |
+|      26 |                    1679.50 |                   15 |
+|      28 |                    1873.90 |                   15 |
+|      30 |                    2070.90 |                   14 |
+|      32 |                    2325.40 |                   14 |
+
+## Analysis
+
+The benchmark results demonstrate the following performance characteristics:
+
+1. **Best Performance**: Cloned engines with cloned inputs consistently deliver the highest throughput
+2. **Configuration Performance Hierarchy**:
+   - Cloned engines, cloned inputs: Best performance (optimal configuration)
+   - Cloned engines, fresh inputs: ~30% reduction from optimal
+   - Fresh engines, cloned inputs: ~86% reduction from optimal
+   - Fresh engines, fresh inputs: ~87% reduction from optimal
+3. **Scaling Patterns**: 
+   - Performance degrades with increased thread count due to contention
+   - Best throughput achieved at 1 thread for cloned engine configurations
+   - Fresh engine configurations show poor scaling across all thread counts
+4. **Engine Creation Overhead**: Fresh engine creation is a significant performance bottleneck (~7-8x slower than cloned engines)
+5. **Input Processing**: Fresh input generation adds moderate overhead (~30% impact compared to cloned inputs)
+6. **Thread Contention**: Performance degradation occurs with higher thread counts across all configurations

benches/evaluation/engine_evaluation_benchmark.rs

@@ -0,0 +1,228 @@
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
+use regorus::{Engine, Value};
+use std::collections::HashMap;
+use std::hint::black_box;
+use std::sync::{Arc, Barrier, Mutex};
+use std::thread;
+use std::time::Duration;
+
+mod policy_data;
+
+fn multi_threaded_eval(
+    num_threads: usize,
+    evals_per_thread: usize,
+    use_cloned_engines: bool,
+    use_cloned_inputs: bool,
+) -> (std::time::Duration, HashMap<String, usize>, usize) {
+    // Complex policies with multiple valid inputs for each
+    let policies_with_inputs = policy_data::policies_with_inputs();
+
+    // Policy names for tracking
+    let policy_names = policy_data::policy_names()
+        .into_iter()
+        .map(|s| s.to_string())
+        .collect::<Vec<_>>();
+
+    // Initialize policy evaluation counters
+    let policy_counters = Arc::new(Mutex::new(HashMap::new()));
+    for policy_name in &policy_names {
+        policy_counters
+            .lock()
+            .unwrap()
+            .insert(policy_name.to_string(), 0);
+    }
+
+    let barrier = Arc::new(Barrier::new(num_threads));
+    let mut handles = Vec::with_capacity(num_threads);
+
+    let total_evals = Arc::new(Mutex::new(0usize));
+    for thread_id in 0..num_threads {
+        let barrier = barrier.clone();
+        let policies_with_inputs = policies_with_inputs.clone();
+        let policy_names = policy_names.clone();
+        let policy_counters = policy_counters.clone();
+        let total_evals = total_evals.clone();
+
+        handles.push(thread::spawn(move || {
+            let mut elapsed = std::time::Duration::ZERO;
+
+            // Pre-create engines if using cloned engines
+            let engines = if use_cloned_engines {
+                Some(
+                    policies_with_inputs
+                        .iter()
+                        .map(|(policy, _)| {
+                            let mut engine = Engine::new();
+                            engine
+                                .add_policy("policy.rego".to_string(), policy.to_string())
+                                .unwrap();
+                            {
+                                // Warm up the engine to ensure it's fully prepared for evaluation.
+                                // This prevents each cloned engine from repeating preparation work.
+                                engine.set_input(Value::new_object());
+                                let _ = engine.eval_rule("data.bench.allow".to_string());
+                            }
+                            engine
+                        })
+                        .collect::<Vec<_>>(),
+                )
+            } else {
+                None
+            };
+
+            // Pre-parse inputs if using cloned inputs
+            let parsed_inputs = if use_cloned_inputs {
+                Some(
+                    policies_with_inputs
+                        .iter()
+                        .map(|(_, inputs)| {
+                            inputs
+                                .iter()
+                                .map(|input_str| regorus::Value::from_json_str(input_str).unwrap())
+                                .collect::<Vec<_>>()
+                        })
+                        .collect::<Vec<_>>(),
+                )
+            } else {
+                None
+            };
+
+            barrier.wait();
+            for i in 0..evals_per_thread {
+                // Use different policy for each iteration - thread_id ensures different threads
+                // start with different policies for better load distribution
+                let policy_idx = (thread_id + i) % policies_with_inputs.len();
+                let (policy, inputs) = &policies_with_inputs[policy_idx];
+
+                // Use different input for the same policy based on iteration - thread_id ensures
+                // different threads start with different inputs for better load distribution
+                let input_idx = (thread_id + i) % inputs.len();
+                let input = &inputs[input_idx];
+
+                let start = std::time::Instant::now();
+
+                let result = {
+                    let mut engine = if use_cloned_engines {
+                        engines.as_ref().unwrap()[policy_idx].clone()
+                    } else {
+                        let mut engine = Engine::new();
+                        engine
+                            .add_policy("policy.rego".to_string(), policy.to_string())
+                            .unwrap();
+                        engine
+                    };
+
+                    let input_value = if use_cloned_inputs {
+                        parsed_inputs.as_ref().unwrap()[policy_idx][input_idx].clone()
+                    } else {
+                        regorus::Value::from_json_str(input).unwrap()
+                    };
+
+                    engine.set_input(input_value);
+
+                    engine.eval_rule("data.bench.allow".to_string())
+
+                    // Engine cleanup/drop time is included in measurement to reflect
+                    // real-world total cost of policy evaluation lifecycle
+                };
+                elapsed += start.elapsed();
+
+                // Track total and successful evaluations
+                {
+                    let mut total = total_evals.lock().unwrap();
+                    *total += 1;
+                }
+                if result.is_ok() {
+                    if let Some(policy_name) = policy_names.get(policy_idx) {
+                        let mut counters = policy_counters.lock().unwrap();
+                        *counters.entry(policy_name.to_string()).or_insert(0) += 1;
+                    }
+                }
+            }
+            elapsed
+        }));
+    }
+
+    let mut total = std::time::Duration::ZERO;
+    for handle in handles {
+        total += handle.join().unwrap();
+    }
+
+    let final_counters = policy_counters.lock().unwrap().clone();
+    let total_evals = *total_evals.lock().unwrap();
+    (total, final_counters, total_evals)
+}
+
+fn criterion_benchmark(c: &mut Criterion) {
+    let max_threads = num_cpus::get() * 2;
+    println!("Running benchmark with max_threads: {}", max_threads);
+
+    let evals_per_thread = 1000;
+
+    // Benchmark all combinations of cloned engines and inputs
+    for use_cloned_engines in [true, false] {
+        for use_cloned_inputs in [true, false] {
+            let group_name = match (use_cloned_engines, use_cloned_inputs) {
+                (true, true) => "cloned_engines , cloned_inputs ",
+                (true, false) => "cloned_engines , fresh_inputs  ",
+                (false, true) => "fresh_engines  , cloned_inputs ",
+                (false, false) => "fresh_engines  , fresh_inputs  ",
+            };
+
+            let mut group = c.benchmark_group(group_name);
+            group.measurement_time(Duration::from_secs(5));
+
+            // Test specific thread counts: powers of 2 + some intermediate values
+            let thread_counts: Vec<usize> = (1..=max_threads)
+                .filter(|&n| {
+                    n == 1 || // Always test single-threaded
+                    n % 2 == 0 || // Always test even threads
+                    n == max_threads // Maximum threads
+                })
+                .collect();
+
+            for threads in thread_counts {
+                let total_evals = threads * evals_per_thread;
+                group.throughput(Throughput::Elements(total_evals as u64));
+                group.bench_with_input(
+                    BenchmarkId::new("eval", format!(" {threads} threads")),
+                    &threads,
+                    |b, &threads| {
+                        b.iter_custom(|iters| {
+                            let evals_per_thread = evals_per_thread * (iters as usize);
+
+                            let (duration, policy_counters, total_evals_aggregated) = multi_threaded_eval(
+                                black_box(threads),
+                                black_box(evals_per_thread),
+                                black_box(use_cloned_engines),
+                                black_box(use_cloned_inputs),
+                            );
+
+
+                            // Sanity check: Ensure the expected number of evaluations matches the actual number performed per iteration batch.
+                            // total_evals is the expected number for this batch, total_evals_aggregated is the sum over all iters.
+                            assert_eq!(total_evals, total_evals_aggregated/iters as usize);
+
+                            // On one iteration, print policy evaluation statistics
+                            if iters == 1 {
+                                // println!("\nPolicy Evaluation Statistics:");
+                                for (policy_name, count) in &policy_counters {
+                                    // println!("  {}: {} evaluations", policy_name, count);
+                                    if *count == 0 {
+                                        println!("\x1b[31mERROR: Policy '{}' was never evaluated successfully!\x1b[0m", policy_name);
+                                    }
+                                }
+                            }
+
+                            duration
+                        });
+                    },
+                );
+            }
+            group.finish();
+        }
+    }
+}
+
+criterion_group!(benches, criterion_benchmark);
+criterion_main!(benches);

benches/evaluation/policy_data.rs

@@ -0,0 +1,117 @@
+// This module provides the full set of policies, inputs, and policy names for evaluation benchmarks.
+// Policies and inputs are now loaded from external files.
+
+use std::fs;
+use std::path::Path;
+
+pub fn policies_with_inputs() -> Vec<(String, Vec<String>)> {
+    let policy_with_input_files = [
+        (
+            "rbac_policy.rego",
+            vec!["rbac_input.json", "rbac_input2.json", "rbac_input3.json"],
+        ),
+        (
+            "api_access_policy.rego",
+            vec![
+                "api_access_input.json",
+                "api_access_input2.json",
+                "api_access_input3.json",
+            ],
+        ),
+        (
+            "data_sensitivity_policy.rego",
+            vec![
+                "data_sensitivity_input.json",
+                "data_sensitivity_input2.json",
+                "data_sensitivity_input3.json",
+            ],
+        ),
+        (
+            "time_based_policy.rego",
+            vec![
+                "time_based_input.json",
+                "time_based_input2.json",
+                "time_based_input3.json",
+            ],
+        ),
+        (
+            "data_processing_policy.rego",
+            vec![
+                "data_processing_input.json",
+                "data_processing_input2.json",
+                "data_processing_input3.json",
+            ],
+        ),
+        (
+            "azure_vm_policy.rego",
+            vec![
+                "azure_vm_input.json",
+                "azure_vm_input2.json",
+                "azure_vm_input3.json",
+            ],
+        ),
+        (
+            "azure_storage_policy.rego",
+            vec![
+                "azure_storage_input.json",
+                "azure_storage_input2.json",
+                "azure_storage_input3.json",
+            ],
+        ),
+        (
+            "azure_keyvault_policy.rego",
+            vec![
+                "azure_keyvault_input.json",
+                "azure_keyvault_input2.json",
+                "azure_keyvault_input3.json",
+            ],
+        ),
+        (
+            "azure_nsg_policy.rego",
+            vec![
+                "azure_nsg_input.json",
+                "azure_nsg_input2.json",
+                "azure_nsg_input3.json",
+            ],
+        ),
+    ];
+
+    let mut policies_and_inputs = Vec::new();
+    let base_dir = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("benches")
+        .join("evaluation")
+        .join("test_data");
+
+    for (policy_file, input_files) in policy_with_input_files.iter() {
+        let policy_path = base_dir.join("policies").join(policy_file);
+
+        let policy_content = fs::read_to_string(&policy_path)
+            .unwrap_or_else(|e| panic!("Failed to read policy file {:?}: {}", policy_path, e));
+
+        let mut input_contents = Vec::new();
+        for input_file in input_files {
+            let input_path = base_dir.join("inputs").join(input_file);
+            let input_content = fs::read_to_string(&input_path)
+                .unwrap_or_else(|e| panic!("Failed to read input file {:?}: {}", input_path, e));
+            input_contents.push(input_content);
+        }
+
+        policies_and_inputs.push((policy_content, input_contents));
+    }
+
+    policies_and_inputs
+}
+
+pub fn policy_names() -> Vec<&'static str> {
+    vec![
+        "rbac_policy",
+        "api_access_policy",
+        "data_sensitivity_policy",
+        "time_based_policy",
+        "data_processing_policy",
+        "azure_vm_policy",
+        "azure_storage_policy",
+        "azure_keyvault_policy",
+        "azure_nsg_policy",
+    ]
+}

benches/evaluation/test_data/inputs/api_access_input.json

@@ -0,0 +1,15 @@
+{
+  "request": {
+    "method": "GET",
+    "path": "/api/v1/users/123"
+  },
+  "user": {
+    "id": "user123",
+    "scope": ["read:users", "write:users"],
+    "department": "engineering"
+  },
+  "resource": {
+    "owner": "user123",
+    "type": "user"
+  }
+}

benches/evaluation/test_data/inputs/api_access_input2.json

@@ -0,0 +1,15 @@
+{
+  "request": {
+    "method": "POST",
+    "path": "/api/v1/users"
+  },
+  "user": {
+    "id": "user456",
+    "scope": ["write:users", "admin:users"],
+    "department": "engineering"
+  },
+  "resource": {
+    "owner": "user456",
+    "type": "user"
+  }
+}

benches/evaluation/test_data/inputs/api_access_input3.json

@@ -0,0 +1,15 @@
+{
+  "request": {
+    "method": "DELETE",
+    "path": "/api/v1/users/789"
+  },
+  "user": {
+    "id": "admin123",
+    "scope": ["admin:users"],
+    "department": "security"
+  },
+  "resource": {
+    "owner": "user789",
+    "type": "user"
+  }
+}

benches/evaluation/test_data/inputs/azure_keyvault_input.json

@@ -0,0 +1,16 @@
+{
+  "vault": {
+    "name": "mykeyvault",
+    "location": "eastus",
+    "enableSoftDelete": true,
+    "softDeleteRetentionInDays": 90,
+    "enablePurgeProtection": true,
+    "networkAcls": {
+      "defaultAction": "Deny",
+      "bypass": "AzureServices"
+    },
+    "tags": {
+      "environment": "production"
+    }
+  }
+}

benches/evaluation/test_data/inputs/azure_keyvault_input2.json

@@ -0,0 +1,16 @@
+{
+  "vault": {
+    "name": "devkeyvault",
+    "location": "westus2",
+    "enableSoftDelete": true,
+    "softDeleteRetentionInDays": 30,
+    "enablePurgeProtection": false,
+    "networkAcls": {
+      "defaultAction": "Allow",
+      "bypass": "AzureServices"
+    },
+    "tags": {
+      "environment": "development"
+    }
+  }
+}

benches/evaluation/test_data/inputs/azure_keyvault_input3.json

@@ -0,0 +1,16 @@
+{
+  "vault": {
+    "name": "prodkeyvault",
+    "location": "eastus",
+    "enableSoftDelete": true,
+    "softDeleteRetentionInDays": 90,
+    "enablePurgeProtection": true,
+    "networkAcls": {
+      "defaultAction": "Deny",
+      "bypass": "AzureServices"
+    },
+    "tags": {
+      "environment": "production"
+    }
+  }
+}

benches/evaluation/test_data/inputs/azure_nsg_input.json

@@ -0,0 +1,13 @@
+{
+  "operation": "Microsoft.Network/networkSecurityGroups/securityRules/write",
+  "rule": {
+    "direction": "Inbound",
+    "access": "Allow",
+    "protocol": "TCP",
+    "sourceAddressPrefix": "10.0.0.0/24",
+    "sourcePortRange": "*",
+    "destinationAddressPrefix": "*",
+    "destinationPortRange": "80",
+    "priority": 1001
+  }
+}

benches/evaluation/test_data/inputs/azure_nsg_input2.json

@@ -0,0 +1,13 @@
+{
+  "operation": "Microsoft.Network/networkSecurityGroups/securityRules/write",
+  "rule": {
+    "direction": "Inbound",
+    "access": "Allow",
+    "protocol": "TCP",
+    "sourceAddressPrefix": "172.16.0.0/16",
+    "sourcePortRange": "*",
+    "destinationAddressPrefix": "*",
+    "destinationPortRange": "22",
+    "priority": 1200
+  }
+}

benches/evaluation/test_data/inputs/azure_nsg_input3.json

@@ -0,0 +1,13 @@
+{
+  "operation": "Microsoft.Network/networkSecurityGroups/securityRules/write",
+  "rule": {
+    "direction": "Inbound",
+    "access": "Allow",
+    "protocol": "TCP",
+    "sourceAddressPrefix": "203.0.113.0/24",
+    "sourcePortRange": "*",
+    "destinationAddressPrefix": "*",
+    "destinationPortRange": "443",
+    "priority": 300
+  }
+}

benches/evaluation/test_data/inputs/azure_storage_input.json

@@ -0,0 +1,15 @@
+{
+  "account": {
+    "name": "mystorageaccount",
+    "tier": "Standard",
+    "replication": "LRS",
+    "location": "eastus",
+    "tags": {
+      "environment": "production"
+    }
+  },
+  "container": {
+    "name": "data",
+    "publicAccess": "None"
+  }
+}

benches/evaluation/test_data/inputs/azure_storage_input2.json

@@ -0,0 +1,15 @@
+{
+  "account": {
+    "name": "devstorageaccount",
+    "tier": "Premium",
+    "replication": "LRS",
+    "location": "westus2",
+    "tags": {
+      "environment": "production"
+    }
+  },
+  "container": {
+    "name": "logs",
+    "publicAccess": "None"
+  }
+}

benches/evaluation/test_data/inputs/azure_storage_input3.json

@@ -0,0 +1,15 @@
+{
+  "account": {
+    "name": "prodstorageaccount",
+    "tier": "Standard",
+    "replication": "GRS",
+    "location": "eastus",
+    "tags": {
+      "environment": "production"
+    }
+  },
+  "container": {
+    "name": "backups",
+    "publicAccess": "None"
+  }
+}

benches/evaluation/test_data/inputs/azure_vm_input.json

@@ -0,0 +1,14 @@
+{
+  "vm": {
+    "size": "Standard_D2s_v3",
+    "os": "Linux",
+    "location": "eastus",
+    "tags": {
+      "environment": "production",
+      "department": "engineering"
+    }
+  },
+  "user": {
+    "department": "engineering"
+  }
+}

benches/evaluation/test_data/inputs/azure_vm_input2.json

@@ -0,0 +1,14 @@
+{
+  "vm": {
+    "size": "Standard_B1s",
+    "os": "Windows",
+    "location": "westus2",
+    "tags": {
+      "environment": "dev",
+      "department": "marketing"
+    }
+  },
+  "user": {
+    "department": "marketing"
+  }
+}

benches/evaluation/test_data/inputs/azure_vm_input3.json

@@ -0,0 +1,14 @@
+{
+  "vm": {
+    "size": "Standard_D4s_v3",
+    "os": "Linux",
+    "location": "eastus",
+    "tags": {
+      "environment": "production",
+      "department": "engineering"
+    }
+  },
+  "user": {
+    "department": "engineering"
+  }
+}

benches/evaluation/test_data/inputs/data_processing_input.json

@@ -0,0 +1,16 @@
+{
+  "operation": "collect",
+  "data": {
+    "type": "email",
+    "source": "user_input"
+  },
+  "consent": {
+    "given": true,
+    "purpose": "marketing",
+    "date": "2023-01-15"
+  },
+  "user": {
+    "age": 25,
+    "location": "US"
+  }
+}

benches/evaluation/test_data/inputs/data_processing_input2.json

@@ -0,0 +1,16 @@
+{
+  "operation": "process",
+  "data": {
+    "type": "survey_response",
+    "source": "user_input"
+  },
+  "consent": {
+    "given": true,
+    "purpose": "analytics",
+    "date": "2023-06-15"
+  },
+  "user": {
+    "age": 30,
+    "location": "US"
+  }
+}

benches/evaluation/test_data/inputs/data_processing_input3.json

@@ -0,0 +1,16 @@
+{
+  "operation": "delete",
+  "data": {
+    "type": "user_profile",
+    "source": "database"
+  },
+  "consent": {
+    "given": false,
+    "purpose": "none",
+    "date": "2022-01-01"
+  },
+  "user": {
+    "age": 16,
+    "location": "EU"
+  }
+}

benches/evaluation/test_data/inputs/data_sensitivity_input.json

@@ -0,0 +1,13 @@
+{
+  "data": {
+    "type": "user_profile",
+    "classification": "personal",
+    "contains_pii": true,
+    "region": "EU"
+  },
+  "user": {
+    "clearance": "confidential",
+    "location": "EU"
+  },
+  "operation": "read"
+}

benches/evaluation/test_data/inputs/data_sensitivity_input2.json

@@ -0,0 +1,13 @@
+{
+  "data": {
+    "type": "financial_report",
+    "classification": "confidential",
+    "contains_pii": false,
+    "region": "US"
+  },
+  "user": {
+    "clearance": "secret",
+    "location": "US"
+  },
+  "operation": "read"
+}

benches/evaluation/test_data/inputs/data_sensitivity_input3.json

@@ -0,0 +1,13 @@
+{
+  "data": {
+    "type": "public_announcement",
+    "classification": "public",
+    "contains_pii": false,
+    "region": "GLOBAL"
+  },
+  "user": {
+    "clearance": "public",
+    "location": "EU"
+  },
+  "operation": "read"
+}

benches/evaluation/test_data/inputs/rbac_input.json

@@ -0,0 +1,12 @@
+{
+  "user": {
+    "name": "alice",
+    "roles": ["viewer", "editor"]
+  },
+  "resource": {
+    "name": "document1",
+    "type": "document",
+    "owner": "alice"
+  },
+  "action": "read"
+}

benches/evaluation/test_data/inputs/rbac_input2.json

@@ -0,0 +1,12 @@
+{
+  "user": {
+    "name": "bob",
+    "roles": ["admin"]
+  },
+  "resource": {
+    "name": "document2",
+    "type": "document",
+    "owner": "bob"
+  },
+  "action": "write"
+}

benches/evaluation/test_data/inputs/rbac_input3.json

@@ -0,0 +1,12 @@
+{
+  "user": {
+    "name": "charlie",
+    "roles": ["viewer"]
+  },
+  "resource": {
+    "name": "document3",
+    "type": "document",
+    "owner": "alice"
+  },
+  "action": "read"
+}

benches/evaluation/test_data/inputs/time_based_input.json

@@ -0,0 +1,11 @@
+{
+  "time": "09:30:00",
+  "day": "monday",
+  "user": {
+    "role": "employee",
+    "shift": "day"
+  },
+  "request": {
+    "urgent": false
+  }
+}

benches/evaluation/test_data/inputs/time_based_input2.json

@@ -0,0 +1,11 @@
+{
+  "time": "14:30:00",
+  "day": "wednesday",
+  "user": {
+    "role": "employee",
+    "shift": "day"
+  },
+  "request": {
+    "urgent": false
+  }
+}

benches/evaluation/test_data/inputs/time_based_input3.json

@@ -0,0 +1,11 @@
+{
+  "time": "22:00:00",
+  "day": "friday",
+  "user": {
+    "role": "admin",
+    "shift": "night"
+  },
+  "request": {
+    "urgent": true
+  }
+}

benches/evaluation/test_data/policies/api_access_policy.rego

@@ -0,0 +1,13 @@
+package bench
+
+default allow := false
+
+valid_api_paths := ["/api/v1/", "/api/v2/", "/api/v3/"]
+
+allow if {
+    input.request.method == "GET"
+    some path in valid_api_paths
+    startswith(input.request.path, path)
+    input.user.authenticated == true
+    time.now_ns() - input.user.login_time < 86400000000000  # 24 hours in nanoseconds
+}

benches/evaluation/test_data/policies/azure_keyvault_policy.rego

@@ -0,0 +1,28 @@
+package bench
+
+default allow := false
+
+# Azure Key Vault access policy
+valid_operations := [
+    "Microsoft.KeyVault/vaults/keys/read",
+    "Microsoft.KeyVault/vaults/secrets/read",
+    "Microsoft.KeyVault/vaults/certificates/read"
+]
+
+vault_admins := ["admin@company.com", "security@company.com"]
+
+allow if {
+    input.operation in valid_operations
+    input.principal.type == "ServicePrincipal"
+    input.principal.appId != ""
+    input.resource.properties.enableSoftDelete == true
+    input.resource.properties.enablePurgeProtection == true
+    time.now_ns() - input.principal.createdTime < 31536000000000000  # Less than 1 year old
+}
+
+allow if {
+    input.operation in valid_operations
+    input.principal.type == "User"
+    input.principal.userPrincipalName in vault_admins
+    input.context.conditionalAccess.compliant == true
+}

benches/evaluation/test_data/policies/azure_nsg_policy.rego

@@ -0,0 +1,31 @@
+package bench
+
+default allow := false
+
+# Azure Network Security Group rules policy
+dangerous_ports := [22, 3389, 1433, 3306, 5432, 6379, 27017]
+internal_networks := ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+is_internal_source if {
+    some network in internal_networks
+    net.cidr_contains(network, input.rule.sourceAddressPrefix)
+}
+
+allow if {
+    input.operation == "Microsoft.Network/networkSecurityGroups/securityRules/write"
+    input.rule.direction == "Inbound"
+    input.rule.access == "Allow"
+    input.rule.destinationPortRange != "*"
+    not input.rule.destinationPortRange in dangerous_ports
+    input.rule.sourceAddressPrefix != "*"
+    input.rule.sourceAddressPrefix != "Internet"
+}
+
+allow if {
+    input.operation == "Microsoft.Network/networkSecurityGroups/securityRules/write"
+    input.rule.direction == "Inbound"
+    input.rule.access == "Allow"
+    input.rule.destinationPortRange in dangerous_ports
+    is_internal_source
+    input.rule.priority >= 1000
+}

benches/evaluation/test_data/policies/azure_storage_policy.rego

@@ -0,0 +1,17 @@
+package bench
+
+default allow := false
+
+# Azure Storage Account security policy
+required_encryption_algorithms := ["AES256", "RSA-OAEP"]
+
+allow if {
+    input.operation == "Microsoft.Storage/storageAccounts/write"
+    input.resource.properties.supportsHttpsTrafficOnly == true
+    input.resource.properties.minimumTlsVersion == "TLS1_2"
+    input.resource.properties.encryption.services.blob.enabled == true
+    input.resource.properties.encryption.keySource == "Microsoft.Storage"
+    input.resource.properties.allowBlobPublicAccess == false
+    input.resource.properties.networkAcls.defaultAction == "Deny"
+    count(input.resource.properties.networkAcls.ipRules) > 0
+}

benches/evaluation/test_data/policies/azure_vm_policy.rego

@@ -0,0 +1,20 @@
+package bench
+
+default allow := false
+
+# Azure VM deployment policy
+allowed_vm_sizes := [
+    "Standard_B1s", "Standard_B2s", "Standard_B4ms",
+    "Standard_D2s_v3", "Standard_D4s_v3", "Standard_F2s_v2"
+]
+
+allowed_regions := ["eastus", "westus2", "northeurope", "southeastasia"]
+
+allow if {
+    input.operation == "Microsoft.Compute/virtualMachines/write"
+    input.resource.properties.hardwareProfile.vmSize in allowed_vm_sizes
+    input.resource.location in allowed_regions
+    input.resource.properties.osProfile.adminPassword == null  # Require SSH keys
+    count(input.resource.tags) > 0  # Must have tags
+    input.resource.tags.environment in ["dev", "test", "prod"]
+}

benches/evaluation/test_data/policies/data_processing_policy.rego

@@ -0,0 +1,28 @@
+package bench
+
+default allow := false
+
+# Complex data filtering and aggregation
+sensitive_fields := ["ssn", "credit_card", "password"]
+
+contains_sensitive_data if {
+    some field in sensitive_fields
+    object.get(input.data, field, null) != null
+}
+
+user_clearance_level := object.get(input.user.attributes, "clearance", 0)
+
+required_clearance := 3 if contains_sensitive_data else := 1
+
+allow if {
+    user_clearance_level >= required_clearance
+    input.operation in ["read", "export"]
+    count(input.data) > 0
+    count(input.data) <= 1000  # Limit data size
+}
+
+allow if {
+    input.user.role == "data_processor"
+    input.operation == "transform"
+    not contains_sensitive_data
+}

benches/evaluation/test_data/policies/data_sensitivity_policy.rego

@@ -0,0 +1,25 @@
+package bench
+
+default allow := false
+
+rbac_roles := {
+    "admin": ["read", "write", "delete", "admin"],
+    "manager": ["read", "write"],
+    "user": ["read"]
+}
+
+user_permissions contains perm if {
+    some role in input.user.roles
+    perm := rbac_roles[role][_]
+}
+
+allow if {
+    input.action in user_permissions
+    input.resource.owner == input.user.id
+}
+
+allow if {
+    input.action in user_permissions
+    input.resource.public == true
+    input.action == "read"
+}

benches/evaluation/test_data/policies/rbac_policy.rego

@@ -0,0 +1,10 @@
+package bench
+
+default allow := false
+
+allow if {
+    input.user.role == "admin"
+    input.action in ["read", "write", "delete"]
+    input.resource.classification in ["public", "internal"]
+    count(input.user.permissions) > 0
+}

benches/evaluation/test_data/policies/time_based_policy.rego

@@ -0,0 +1,23 @@
+package bench
+
+default allow := false
+
+# Time-based access control with complex conditions
+business_hours if {
+    hour := time.clock([time.now_ns(), "America/New_York"])[0]
+    hour >= 9
+    hour < 17
+}
+
+allow if {
+    input.user.department in ["engineering", "product"]
+    input.action == "deploy"
+    business_hours
+    count([x | x := input.approvals[_]; x.status == "approved"]) >= 2
+}
+
+allow if {
+    input.user.emergency_access == true
+    input.action in ["read", "diagnose"]
+    input.justification != ""
+}

benches/regorus_benchmark.rs

@@ -0,0 +1,151 @@
+use std::hint::black_box;
+
+use regorus::{Engine, Value};
+
+use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion};
+use serde_json::json;
+
+fn engine_with_policy(policy: &str) -> Engine {
+    let mut engine = Engine::new();
+    engine
+        .add_policy("policy.rego".to_string(), policy.to_string())
+        .unwrap();
+    engine
+}
+
+fn eval_principal(engine: &mut Engine) {
+    engine.set_input(black_box(json!({"principal": "admin"}).into()));
+    let result = engine
+        .eval_rule(black_box("data.bench.allow".to_string()))
+        .unwrap();
+    assert_eq!(result, true.into());
+}
+
+fn allow_with_simple_equality(c: &mut Criterion) {
+    c.bench_function("simple equality check with constant", |b| {
+        let mut engine = engine_with_policy(
+            r#"
+            package bench
+            allow if input.principal == "admin"
+            "#,
+        );
+
+        b.iter(|| eval_principal(&mut engine))
+    });
+
+    c.bench_function("simple equality check with data", |b| {
+        let mut engine = engine_with_policy(
+            r#"
+            package bench
+            allow if input.principal == data.allowed_principal
+            "#,
+        );
+        engine
+            .add_data(json!({"allowed_principal": "admin"}).into())
+            .unwrap();
+
+        b.iter(|| eval_principal(&mut engine))
+    });
+}
+
+fn allow_with_simple_membership(c: &mut Criterion) {
+    let generate_principals = |n: usize| {
+        (0..n)
+            .map(|i| i.to_string())
+            .chain(std::iter::once("admin".to_string()))
+            .collect::<Vec<_>>()
+    };
+
+    let mut group = c.benchmark_group("allow with simple membership");
+    for size in [32, 64, 128, 512, 1024, 2048].iter() {
+        group.bench_with_input(BenchmarkId::new("with constant", size), size, |b, &size| {
+            let principals = generate_principals(size).join("\",\"");
+            let mut engine = engine_with_policy(&format!(
+                r#"
+                package bench
+
+                allowed_principals := {{
+                    "{principals}"
+                }}
+
+                allow if input.principal in allowed_principals
+                "#
+            ));
+
+            b.iter(|| eval_principal(&mut engine))
+        });
+
+        group.bench_with_input(BenchmarkId::new("with data", size), size, |b, &size| {
+            let principals = generate_principals(size);
+            let mut engine = engine_with_policy(
+                r#"
+                package bench
+                allow if input.principal in data.allowed_principals
+                "#,
+            );
+            engine
+                .add_data(json!({"allowed_principals": principals}).into())
+                .unwrap();
+
+            b.iter(|| eval_principal(&mut engine))
+        });
+    }
+    group.finish();
+}
+
+fn clone(c: &mut Criterion) {
+    // Use Arc<BtreeMap> as a reference. Clone will only increment
+    // the reference count.
+    let mut m = std::collections::BTreeMap::default();
+    m.insert(1, 2);
+    let m = std::sync::Arc::new(m);
+
+    c.bench_function("clone: Arc<BTreeMap>", |b| {
+        b.iter(|| {
+            let _ = m.clone();
+        })
+    });
+
+    let mut engine = Engine::new();
+    engine.set_rego_v0(true);
+    engine
+        .add_policy_from_file("tests/aci/framework.rego")
+        .unwrap();
+    engine.add_policy_from_file("tests/aci/api.rego").unwrap();
+    engine
+        .add_policy_from_file("tests/aci/policy.rego")
+        .unwrap();
+    engine
+        .add_data(Value::from_json_file("tests/aci/data.json").expect("failed to load data.json"))
+        .expect("failed to add data");
+    engine.set_input(
+        Value::from_json_file("tests/aci/input.json").expect("failed to load input.json"),
+    );
+
+    // An engine without preparation will not have processed fields populated.
+    c.bench_function("clone: engine with aci policies", |b| {
+        b.iter(|| {
+            let _ = engine.clone();
+        })
+    });
+
+    // Trigger engine preparation.
+    let _ = engine.eval_query("data.framework.mount_overlay".to_string(), false);
+
+    // Prepared engine will have many more fields populated. But the fields are
+    // immutable after preparation and will be shared between clones.
+    c.bench_function("clone: prepared engine with aci policies", |b| {
+        b.iter(|| {
+            let _ = engine.clone();
+        })
+    });
+}
+
+criterion_group!(
+    benches,
+    allow_with_simple_equality,
+    allow_with_simple_membership,
+    clone
+);
+
+criterion_main!(benches);

benches/schema_validation_benchmark.rs

@@ -0,0 +1,886 @@
+use criterion::{criterion_group, criterion_main, Criterion};
+use regorus::Value;
+use regorus::{Schema, SchemaValidator};
+use serde_json::json;
+
+// Observed: validate_string - 3.19 ns/iter
+fn bench_string_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "string",
+        "minLength": 3,
+        "maxLength": 10
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from("hello");
+
+    c.bench_function("validate_string", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_number - 146.5 ns/iter
+fn bench_number_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "number",
+        "minimum": 0.0,
+        "maximum": 100.0
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(42.5);
+
+    c.bench_function("validate_number", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_array - 95.0 ns/iter
+fn bench_array_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "array",
+        "items": { "type": "integer" },
+        "minItems": 2,
+        "maxItems": 5
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!([1, 2, 3]));
+
+    c.bench_function("validate_array", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_object - 126.9 ns/iter
+fn bench_object_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" },
+            "age": { "type": "integer", "minimum": 0 }
+        },
+        "required": ["name", "age"]
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({"name": "Alice", "age": 30}));
+
+    c.bench_function("validate_object", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_complex_nested - 710.5 ns/iter
+fn bench_complex_nested_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "user": {
+                "type": "object",
+                "properties": {
+                    "id": { "type": "string" },
+                    "profile": {
+                        "type": "object",
+                        "properties": {
+                            "email": { "type": "string" },
+                            "roles": {
+                                "type": "array",
+                                "items": { "type": "string" }
+                            }
+                        },
+                        "required": ["email", "roles"]
+                    }
+                },
+                "required": ["id", "profile"]
+            },
+            "active": { "type": "boolean" }
+        },
+        "required": ["user", "active"]
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "user": {
+            "id": "u123",
+            "profile": {
+                "email": "alice@example.com",
+                "roles": ["admin", "user"]
+            }
+        },
+        "active": true
+    }));
+
+    c.bench_function("validate_complex_nested", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_string_pattern - 29.99 µs/iter
+fn bench_string_pattern_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "string",
+        "pattern": "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$"
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from("user@example.com");
+
+    c.bench_function("validate_string_pattern", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_enum - 7.26 ns/iter
+fn bench_enum_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "enum": ["pending", "approved", "rejected", "cancelled"]
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from("approved");
+
+    c.bench_function("validate_enum", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_boolean - 3.22 ns/iter
+fn bench_boolean_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "boolean"
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(true);
+
+    c.bench_function("validate_boolean", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_null - 3.22 ns/iter
+fn bench_null_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "null"
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::Null;
+
+    c.bench_function("validate_null", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_large_array - 17.30 µs/iter
+fn bench_large_array_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "array",
+        "items": { "type": "number" },
+        "minItems": 50,
+        "maxItems": 200
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let large_array: Vec<_> = (0..100).map(|i| json!(i as f64)).collect();
+    let value = Value::from(json!(large_array));
+
+    c.bench_function("validate_large_array", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_deeply_nested - 468.2 ns/iter
+fn bench_deeply_nested_object(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "level1": {
+                "type": "object",
+                "properties": {
+                    "level2": {
+                        "type": "object",
+                        "properties": {
+                            "level3": {
+                                "type": "object",
+                                "properties": {
+                                    "level4": {
+                                        "type": "object",
+                                        "properties": {
+                                            "level5": {
+                                                "type": "string"
+                                            }
+                                        },
+                                        "required": ["level5"]
+                                    }
+                                },
+                                "required": ["level4"]
+                            }
+                        },
+                        "required": ["level3"]
+                    }
+                },
+                "required": ["level2"]
+            }
+        },
+        "required": ["level1"]
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "level1": {
+            "level2": {
+                "level3": {
+                    "level4": {
+                        "level5": "deep value"
+                    }
+                }
+            }
+        }
+    }));
+
+    c.bench_function("validate_deeply_nested", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_mixed_type_array - 1.36 µs/iter
+fn bench_mixed_type_array(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "array",
+        "items": {
+            "anyOf": [
+                { "type": "string" },
+                { "type": "number" },
+                { "type": "boolean" }
+            ]
+        }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!(["hello", 42, true, "world", 3.14, false]));
+
+    c.bench_function("validate_mixed_type_array", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_additional_properties - 366.4 ns/iter
+fn bench_additional_properties(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "name": { "type": "string" },
+            "age": { "type": "integer" }
+        },
+        "additionalProperties": { "type": "string" },
+        "required": ["name"]
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "name": "Alice",
+        "age": 30,
+        "city": "New York",
+        "country": "USA",
+        "occupation": "Engineer"
+    }));
+
+    c.bench_function("validate_additional_properties", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_array_constraints - 146.2 ns/iter
+fn bench_array_constraints(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "array",
+        "items": { "type": "string" },
+        "minItems": 2,
+        "maxItems": 10
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!(["apple", "banana", "cherry", "date", "elderberry"]));
+
+    c.bench_function("validate_array_constraints", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_multi_level - 915.8 ns/iter
+fn bench_multi_level_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "user": {
+                "type": "object",
+                "properties": {
+                    "profile": {
+                        "type": "object",
+                        "properties": {
+                            "settings": {
+                                "type": "object",
+                                "properties": {
+                                    "theme": {
+                                        "enum": ["light", "dark", "auto"]
+                                    },
+                                    "notifications": {
+                                        "type": "boolean"
+                                    }
+                                },
+                                "required": ["theme"],
+                                "additionalProperties": { "type": "string" }
+                            }
+                        },
+                        "required": ["settings"],
+                        "additionalProperties": { "type": "any" }
+                    }
+                },
+                "required": ["profile"],
+                "additionalProperties": { "type": "any" }
+            }
+        },
+        "required": ["user"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "user": {
+            "profile": {
+                "settings": {
+                    "theme": "dark",
+                    "notifications": true,
+                    "language": "en"
+                },
+                "avatar": "default.png"
+            },
+            "lastLogin": "2024-01-01"
+        },
+        "metadata": "extra info"
+    }));
+
+    c.bench_function("validate_multi_level", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Azure Resource Validation Benchmarks
+
+// Observed: validate_azure_vm_resource - 34.74 µs/iter
+fn bench_azure_vm_resource_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "type": {
+                "const": "Microsoft.Compute/virtualMachines"
+            },
+            "apiVersion": {
+                "enum": ["2021-03-01", "2021-07-01", "2022-03-01"]
+            },
+            "name": {
+                "type": "string",
+                "pattern": "^[a-zA-Z0-9-._]{1,64}$"
+            },
+            "location": {
+                "type": "string",
+                "description": "Azure region where the VM will be deployed"
+            },
+            "properties": {
+                "type": "object",
+                "properties": {
+                    "hardwareProfile": {
+                        "type": "object",
+                        "properties": {
+                            "vmSize": {
+                                "enum": ["Standard_B1s", "Standard_B2s", "Standard_D2s_v3", "Standard_D4s_v3"]
+                            }
+                        },
+                        "required": ["vmSize"]
+                    },
+                    "osProfile": {
+                        "type": "object",
+                        "properties": {
+                            "computerName": {
+                                "type": "string"
+                            },
+                            "adminUsername": {
+                                "type": "string"
+                            }
+                        },
+                        "required": ["computerName", "adminUsername"]
+                    }
+                },
+                "required": ["hardwareProfile", "osProfile"]
+            }
+        },
+        "required": ["type", "apiVersion", "name", "location", "properties"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "type": "Microsoft.Compute/virtualMachines",
+        "apiVersion": "2021-03-01",
+        "name": "my-vm-01",
+        "location": "eastus",
+        "properties": {
+            "hardwareProfile": {
+                "vmSize": "Standard_B2s"
+            },
+            "osProfile": {
+                "computerName": "my-computer",
+                "adminUsername": "azureuser"
+            }
+        }
+    }));
+
+    c.bench_function("validate_azure_vm_resource", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_azure_storage_resource - 22.12 µs/iter
+fn bench_azure_storage_resource_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "type": {
+                "const": "Microsoft.Storage/storageAccounts"
+            },
+            "apiVersion": {
+                "enum": ["2021-04-01", "2021-06-01", "2022-05-01"]
+            },
+            "name": {
+                "type": "string",
+                "pattern": "^[a-z0-9]{3,24}$"
+            },
+            "location": {
+                "type": "string"
+            },
+            "sku": {
+                "type": "object",
+                "properties": {
+                    "name": {
+                        "enum": ["Standard_LRS", "Standard_GRS", "Standard_RAGRS", "Premium_LRS"]
+                    }
+                },
+                "required": ["name"]
+            },
+            "kind": {
+                "enum": ["Storage", "StorageV2", "BlobStorage", "FileStorage", "BlockBlobStorage"]
+            },
+            "properties": {
+                "type": "object",
+                "properties": {
+                    "accessTier": {
+                        "enum": ["Hot", "Cool", "Archive"]
+                    },
+                    "encryption": {
+                        "type": "object",
+                        "properties": {
+                            "services": {
+                                "type": "object"
+                            }
+                        }
+                    }
+                },
+                "additionalProperties": { "type": "any" }
+            }
+        },
+        "required": ["type", "apiVersion", "name", "location", "sku", "kind"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "type": "Microsoft.Storage/storageAccounts",
+        "apiVersion": "2021-04-01",
+        "name": "mystorageaccount001",
+        "location": "westus2",
+        "sku": {
+            "name": "Standard_LRS"
+        },
+        "kind": "StorageV2",
+        "properties": {
+            "accessTier": "Hot",
+            "encryption": {
+                "services": {}
+            }
+        }
+    }));
+
+    c.bench_function("validate_azure_storage_resource", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_azure_arm_template - 1.99 µs/iter
+fn bench_azure_arm_template_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "$schema": {
+                "type": "string"
+            },
+            "contentVersion": {
+                "type": "string"
+            },
+            "parameters": {
+                "type": "object",
+                "additionalProperties": { "type": "any" }
+            },
+            "variables": {
+                "type": "object",
+                "additionalProperties": { "type": "any" }
+            },
+            "resources": {
+                "type": "array",
+                "items": {
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string"
+                        },
+                        "apiVersion": {
+                            "type": "string"
+                        },
+                        "name": {
+                            "type": "string"
+                        },
+                        "location": {
+                            "type": "string"
+                        },
+                        "properties": {
+                            "type": "object",
+                            "additionalProperties": { "type": "any" }
+                        },
+                        "tags": {
+                            "type": "object",
+                            "additionalProperties": { "type": "string" }
+                        }
+                    },
+                    "required": ["type", "apiVersion", "name"],
+                    "additionalProperties": { "type": "any" }
+                }
+            },
+            "outputs": {
+                "type": "object",
+                "additionalProperties": { "type": "any" }
+            }
+        },
+        "required": ["resources"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+        "contentVersion": "1.0.0.0",
+        "parameters": {
+            "vmName": {
+                "type": "string",
+                "defaultValue": "myVM"
+            }
+        },
+        "variables": {
+            "storageAccountName": "[concat('storage', uniqueString(resourceGroup().id))]"
+        },
+        "resources": [
+            {
+                "type": "Microsoft.Compute/virtualMachines",
+                "apiVersion": "2021-03-01",
+                "name": "[parameters('vmName')]",
+                "location": "[resourceGroup().location]",
+                "properties": {
+                    "hardwareProfile": {
+                        "vmSize": "Standard_B1s"
+                    }
+                },
+                "tags": {
+                    "environment": "dev",
+                    "project": "test"
+                }
+            }
+        ],
+        "outputs": {
+            "vmId": {
+                "type": "string",
+                "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]"
+            }
+        }
+    }));
+
+    c.bench_function("validate_azure_arm_template", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Azure Policy Effect Validation Benchmarks
+
+// Observed: validate_azure_policy_deny_effect - 188.6 ns/iter
+fn bench_azure_policy_deny_effect_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "effect": {
+                "const": "deny"
+            },
+            "description": {
+                "type": "string"
+            }
+        },
+        "required": ["effect"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "effect": "deny",
+        "description": "Deny resources that don't meet security requirements"
+    }));
+
+    c.bench_function("validate_azure_policy_deny_effect", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_azure_policy_audit_effect - 516.7 ns/iter
+fn bench_azure_policy_audit_effect_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "effect": {
+                "const": "audit"
+            },
+            "description": {
+                "type": "string"
+            },
+            "auditDetails": {
+                "type": "object",
+                "properties": {
+                    "category": {
+                        "enum": ["security", "compliance", "cost", "operational"]
+                    },
+                    "severity": {
+                        "enum": ["low", "medium", "high", "critical"]
+                    }
+                },
+                "additionalProperties": { "type": "any" }
+            }
+        },
+        "required": ["effect"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "effect": "audit",
+        "description": "Audit non-compliant resources",
+        "auditDetails": {
+            "category": "security",
+            "severity": "high"
+        }
+    }));
+
+    c.bench_function("validate_azure_policy_audit_effect", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_azure_policy_modify_effect - 1.17 µs/iter
+fn bench_azure_policy_modify_effect_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "effect": {
+                "const": "modify"
+            },
+            "description": {
+                "type": "string"
+            },
+            "modifyDetails": {
+                "type": "object",
+                "properties": {
+                    "roleDefinitionIds": {
+                        "type": "array",
+                        "items": { "type": "string" }
+                    },
+                    "operations": {
+                        "type": "array",
+                        "items": {
+                            "type": "object",
+                            "properties": {
+                                "operation": {
+                                    "enum": ["add", "replace", "remove"]
+                                },
+                                "field": {
+                                    "type": "string"
+                                },
+                                "value": {
+                                "type": "any"
+                            }
+                            },
+                            "required": ["operation", "field"],
+                            "additionalProperties": { "type": "any" }
+                        }
+                    }
+                },
+                "required": ["roleDefinitionIds", "operations"],
+                "additionalProperties": { "type": "any" }
+            }
+        },
+        "required": ["effect", "modifyDetails"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "effect": "modify",
+        "description": "Modify resources to ensure compliance",
+        "modifyDetails": {
+            "roleDefinitionIds": [
+                "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
+            ],
+            "operations": [
+                {
+                    "operation": "add",
+                    "field": "tags.environment",
+                    "value": "production"
+                }
+            ]
+        }
+    }));
+
+    c.bench_function("validate_azure_policy_modify_effect", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+// Observed: validate_azure_policy_complex_effect - 1.40 µs/iter
+fn bench_azure_policy_complex_effect_validation(c: &mut Criterion) {
+    let schema_json = json!({
+        "type": "object",
+        "properties": {
+            "effect": {
+                "enum": ["auditIfNotExists", "deployIfNotExists"]
+            },
+            "parameters": {
+                "type": "object",
+                "additionalProperties": { "type": "any" }
+            },
+            "existenceCondition": {
+                "type": "object",
+                "properties": {
+                    "field": { "type": "string" },
+                    "equals": { "type": "string" }
+                },
+                "required": ["field"],
+                "additionalProperties": { "type": "any" }
+            },
+            "deployment": {
+                "type": "object",
+                "properties": {
+                    "properties": {
+                        "type": "object",
+                        "properties": {
+                            "mode": {
+                                "enum": ["incremental", "complete"]
+                            },
+                            "template": {
+                                "type": "object",
+                                "additionalProperties": { "type": "any" }
+                            },
+                            "parameters": {
+                                "type": "object",
+                                "additionalProperties": { "type": "any" }
+                            }
+                        },
+                        "required": ["mode", "template"],
+                        "additionalProperties": { "type": "any" }
+                    }
+                },
+                "required": ["properties"],
+                "additionalProperties": { "type": "any" }
+            }
+        },
+        "required": ["effect"],
+        "additionalProperties": { "type": "any" }
+    });
+    let schema = Schema::from_serde_json_value(schema_json).unwrap();
+    let value = Value::from(json!({
+        "effect": "deployIfNotExists",
+        "parameters": {},
+        "existenceCondition": {
+            "field": "Microsoft.Security/complianceResults/resourceStatus",
+            "equals": "OffByPolicy"
+        },
+        "deployment": {
+            "properties": {
+                "mode": "incremental",
+                "template": {
+                    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+                    "contentVersion": "1.0.0.0",
+                    "resources": []
+                },
+                "parameters": {}
+            }
+        }
+    }));
+
+    c.bench_function("validate_azure_policy_complex_effect", |b| {
+        b.iter(|| {
+            SchemaValidator::validate(&value, &schema).unwrap();
+        })
+    });
+}
+
+criterion_group!(
+    schema_validation_benches,
+    bench_string_validation,
+    bench_number_validation,
+    bench_array_validation,
+    bench_object_validation,
+    bench_complex_nested_validation,
+    bench_string_pattern_validation,
+    bench_enum_validation,
+    bench_boolean_validation,
+    bench_null_validation,
+    bench_large_array_validation,
+    bench_deeply_nested_object,
+    bench_mixed_type_array,
+    bench_additional_properties,
+    bench_array_constraints,
+    bench_multi_level_validation,
+    bench_azure_vm_resource_validation,
+    bench_azure_storage_resource_validation,
+    bench_azure_arm_template_validation,
+    bench_azure_policy_deny_effect_validation,
+    bench_azure_policy_audit_effect_validation,
+    bench_azure_policy_modify_effect_validation,
+    bench_azure_policy_complex_effect_validation
+);
+criterion_main!(schema_validation_benches);

bindings/c-nostd/CMakeLists.txt

@@ -7,7 +7,8 @@ include(FetchContent)
 FetchContent_Declare(
     Corrosion
     GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+    # Use a tag that has a fix for https://github.com/corrosion-rs/corrosion/issues/590
+    GIT_TAG 6be991bb34c348dfb8344be22f3606288ea5c7fd
 )
 FetchContent_MakeAvailable(Corrosion)
 
@@ -31,6 +32,8 @@ corrosion_import_crate(
   # See regorus/opa_no_std
   FEATURES "custom_allocator,regorus/semver"
 
+  LOCKED
+  
   # Link statically
   CRATE_TYPES staticlib FLAGS --crate-type=staticlib
   )

bindings/c-nostd/main.c

@@ -27,7 +27,7 @@ char*  file_to_string(const char* file) {
 
 // If regorus is built with custom-allocator, then provide implementation.
 uint8_t* regorus_aligned_alloc(size_t alignment, size_t size) {
-    return aligned_alloc(alignment, size);
+    return (uint8_t*) aligned_alloc(alignment, size);
 }
 
 void regorus_free(uint8_t* ptr) {
@@ -41,24 +41,29 @@ int main() {
     RegorusResult r;
     char* buffer = NULL;
 
+    // Turn on rego v0 since policy uses v0.
+    r = regorus_engine_set_rego_v0(engine, true);
+    if (r.status != Ok)
+	goto error;
+
     // Load policies.
     r = regorus_engine_add_policy(engine, "framework.rego", (buffer = file_to_string("../../../tests/aci/framework.rego")));
     free(buffer);
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     printf("Loaded package %s\n", r.output);
     regorus_result_drop(r);
 
     r = regorus_engine_add_policy(engine, "api.rego", (buffer = file_to_string("../../../tests/aci/api.rego")));
     free(buffer);
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     printf("Loaded package %s\n", r.output);
     regorus_result_drop(r);
 
     r = regorus_engine_add_policy(engine, "policy.rego", (buffer = file_to_string("../../../tests/aci/policy.rego")));
     free(buffer);
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     printf("Loaded package %s\n", r.output);
     regorus_result_drop(r);
@@ -66,20 +71,20 @@ int main() {
     // Add data
     r = regorus_engine_add_data_json(engine, (buffer = file_to_string("../../../tests/aci/data.json")));
     free(buffer);
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     regorus_result_drop(r);
 
     // Set input
     r = regorus_engine_set_input_json(engine, (buffer = file_to_string("../../../tests/aci/input.json")));
     free(buffer);
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     regorus_result_drop(r);
 
     // Eval rule.
     r = regorus_engine_eval_rule(engine, "data.framework.mount_overlay");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
 
     // Print output

bindings/c/CMakeLists.txt

@@ -7,7 +7,8 @@ include(FetchContent)
 FetchContent_Declare(
     Corrosion
     GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+    # Use a tag that has a fix for https://github.com/corrosion-rs/corrosion/issues/590
+    GIT_TAG 6be991bb34c348dfb8344be22f3606288ea5c7fd
 )
 FetchContent_MakeAvailable(Corrosion)
 
@@ -24,6 +25,8 @@ corrosion_import_crate(
   # Select specific features in regorus.
   FEATURES "regorus/semver"
 
+  LOCKED
+  
   # Link statically
   CRATE_TYPES "cdylib"
   )

bindings/c/main.c

@@ -6,40 +6,45 @@ int main() {
     RegorusEngine* engine = regorus_engine_new();
     RegorusResult r;
 
+    // Turn on rego v0 since policy uses v0.
+    r = regorus_engine_set_rego_v0(engine, true);
+    if (r.status != Ok)
+	goto error;
+
     // Load policies.
     r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/framework.rego");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     printf("Loaded package %s\n", r.output);
     regorus_result_drop(r);
 
     r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/api.rego");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     printf("Loaded package %s\n", r.output);
     regorus_result_drop(r);
     
     r = regorus_engine_add_policy_from_file(engine, "../../../tests/aci/policy.rego");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     printf("Loaded package %s\n", r.output);
     regorus_result_drop(r);
 
     // Add data
     r = regorus_engine_add_data_from_json_file(engine, "../../../tests/aci/data.json");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     regorus_result_drop(r);
 
     // Set input
     r = regorus_engine_set_input_from_json_file(engine, "../../../tests/aci/input.json");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
     regorus_result_drop(r);
 
     // Eval rule.
     r = regorus_engine_eval_query(engine, "data.framework.mount_overlay");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
 
     // Print output
@@ -61,14 +66,14 @@ int main() {
 	);
 
     // Evaluate rule.
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
 
     r = regorus_engine_set_enable_coverage(engine, true);
     regorus_result_drop(r);
     
     r = regorus_engine_eval_query(engine, "data.test.message");
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
 
     // Print output
@@ -77,7 +82,7 @@ int main() {
 	
     // Print pretty coverage report.
     r = regorus_engine_get_coverage_report_pretty(engine);
-    if (r.status != RegorusStatusOk)
+    if (r.status != Ok)
 	goto error;
 
     printf("%s\n", r.output);

bindings/cpp/CMakeLists.txt

@@ -7,13 +7,16 @@ include(FetchContent)
 FetchContent_Declare(
     Corrosion
     GIT_REPOSITORY https://github.com/corrosion-rs/corrosion.git
-    GIT_TAG v0.4 # Optionally specify a commit hash, version tag or branch here
+    # Use a tag that has a fix for https://github.com/corrosion-rs/corrosion/issues/590
+    GIT_TAG 6be991bb34c348dfb8344be22f3606288ea5c7fd
 )
 FetchContent_MakeAvailable(Corrosion)
 
 project("regorus-test")
 set(CMAKE_CXX_STANDARD 17)
 
+# installable ffi target
+
 corrosion_import_crate(
   # Path to <regorus-source-folder>/bindings/ffi/Cargo.toml
   MANIFEST_PATH "../ffi/Cargo.toml"
@@ -25,10 +28,58 @@ corrosion_import_crate(
   # Select specific features in regorus.
   FEATURES "regorus/semver"
 
+  LOCKED
+  
   # Link statically
   CRATE_TYPES "cdylib")
 
+include(GNUInstallDirs)
+
+set(regorus_ffi_INCLUDEDIR ${CMAKE_INSTALL_INCLUDEDIR}/regorus_ffi)
+set(regorus_ffi_CONFIGDIR ${CMAKE_INSTALL_LIBDIR}/cmake/regorus_ffi)
+set(regorus_ffi_LIBDIR ${CMAKE_INSTALL_LIBDIR})
+set(regorus_ffi_BINDIR ${CMAKE_INSTALL_BINDIR})
+
+add_library(regorus_ffi::regorus_ffi ALIAS regorus_ffi)
+corrosion_install(TARGETS regorus_ffi EXPORT regorus_ffi_targets LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR})
+
+target_include_directories(regorus_ffi
+INTERFACE
+    $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
+    $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../ffi>
+    $<INSTALL_INTERFACE:${regorus_ffi_INCLUDEDIR}>
+)
+
+set(regorus_ffi_HEADER_FILES
+  regorus.hpp
+  ../ffi/regorus.ffi.hpp
+)
+
+install(FILES ${regorus_ffi_HEADER_FILES}
+  DESTINATION ${regorus_ffi_INCLUDEDIR}
+  COMPONENT Devel
+)
+
+install(EXPORT regorus_ffi_targets
+  FILE regorus_ffi_targets.cmake
+  NAMESPACE regorus_ffi::
+  DESTINATION ${regorus_ffi_CONFIGDIR}
+)
+
+include(CMakePackageConfigHelpers)
+
+configure_package_config_file(${CMAKE_CURRENT_LIST_DIR}/regorus_ffiConfig.cmake.in
+  ${CMAKE_CURRENT_BINARY_DIR}/regorus_ffiConfig.cmake
+  INSTALL_DESTINATION ${regorus_ffi_CONFIGDIR}
+)
+
+install(FILES
+  ${CMAKE_CURRENT_BINARY_DIR}/regorus_ffiConfig.cmake
+  ${CMAKE_CURRENT_BINARY_DIR}/corrosion/regorus_ffi_targetsCorrosion.cmake
+  DESTINATION ${regorus_ffi_CONFIGDIR}
+)
+
+# test binary
+
 add_executable(regorus_test main.cpp)
-# Add path to <regorus-source-folder>/bindings/ffi
-target_include_directories(regorus_test PRIVATE "../ffi")
-target_link_libraries(regorus_test regorus_ffi)
+target_link_libraries(regorus_test regorus_ffi::regorus_ffi)

bindings/cpp/main.cpp

@@ -6,6 +6,7 @@ void example()
     // Create engine
     regorus::Engine engine;
 
+    engine.set_rego_v0(true);
     engine.set_enable_coverage(true);
     
     // Add policies.
@@ -83,6 +84,7 @@ int main() {
 
     // Create engine.
     regorus::Engine engine;
+    engine.set_rego_v0(true);
 
 
     // Load policies.

bindings/cpp/regorus.hpp

@@ -11,8 +11,8 @@ namespace regorus {
     class Result {
     public:
 
-	operator bool() const { return result.status == RegorusStatus::RegorusStatusOk; }
-	bool operator !() const { return result.status != RegorusStatus::RegorusStatusOk; }
+	operator bool() const { return result.status == RegorusStatus::Ok; }
+	bool operator !() const { return result.status != RegorusStatus::Ok; }
 
 	const char* output() const {
 	    if (*this && result.output) {
@@ -54,6 +54,9 @@ namespace regorus {
 	    return std::unique_ptr<Engine>(new Engine(regorus_engine_clone(engine)));
 	}
 
+	Result set_rego_v0(bool enable) {
+		return Result(regorus_engine_set_rego_v0(engine, enable));
+	}
 
 	Result add_policy(const char* path, const char* policy) {
 	    return Result(regorus_engine_add_policy(engine, path, policy));

bindings/cpp/regorus_ffiConfig.cmake.in

@@ -0,0 +1,3 @@
+@PACKAGE_INIT@
+include("${CMAKE_CURRENT_LIST_DIR}/regorus_ffi_targets.cmake")
+include("${CMAKE_CURRENT_LIST_DIR}/regorus_ffi_targetsCorrosion.cmake")

bindings/csharp/API.md

@@ -0,0 +1,421 @@
+# Regorus C# API Documentation
+
+This document describes the C# API for Regorus, focusing on the compiled policy approach for high-performance policy evaluation.
+
+## Overview
+
+The Regorus C# bindings provide a modern, thread-safe API for compiling and evaluating Open Policy Agent (OPA) Rego policies. The API is designed around pre-compiled policies that can be evaluated efficiently multiple times with different inputs.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                    CompiledPolicy Workflow                      │
+└─────────────────────────────────────────────────────────────────┘
+
+┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
+│  Policy Modules │    │   Target/Schema  │    │   Static Data   │
+│  (.rego files)  │    │    Registries    │    │     (JSON)      │
+└─────────┬───────┘    └────────┬─────────┘    └─────────┬───────┘
+          │                     │                        │
+          └─────────────────────┼────────────────────────┘
+                                │
+                                ▼
+                    ┌─────────────────────────┐
+                    │        Compile          │
+                    │  ┌─────────────────────┐│
+                    │  │ Parse & Analyze     ││
+                    │  │ Infer Resource Types││
+                    │  │ Build AST & Rules   ││
+                    │  │ Target Integration  ││
+                    │  └─────────────────────┘│
+                    └─────────────┬───────────┘
+                                  │
+                                  ▼
+                      ┌─────────────────────────┐
+                      │    CompiledPolicy       │
+                      │ ┌─────────────────────┐ │
+                      │ │ AST & Rules         │ │
+                      │ │ Target Info         │ │
+                      │ │ Resource Types      │ │
+                      │ │ Function Table      │ │
+                      │ │ Compiled Modules    │ │
+                      │ └─────────────────────┘ │
+                      └─────────────┬───────────┘
+                                    │
+                                    ▼
+                          ┌─────────────────────┐
+                          │    Service Cache    │
+                          │ (Policy Framework,  │
+                          │  MS Graph, etc.)    │
+                          │ ┌─────────────────┐ │
+                          │ │ CompiledPolicy  │ │ ◄─── Same LOCK-FREE policy
+                          │ │    (cached)     │ │      instance shared across
+                          │ └─────────────────┘ │      all threads
+                          └─────────┬───────────┘
+                                    │
+                            ┌───────┼───────┬───────┐
+                            │       │       │       │
+                            ▼       ▼       ▼       ▼
+                    ┌─────────────┐ ┌─────────────┐ ┌─────────────┐
+                    │  Thread 1   │ │  Thread 2   │ │  Thread N   │
+                    │             │ │             │ │             │
+                    │ input1 ────▶│ │ input2 ────▶│ │ inputN ────▶│
+                    │ ◄─── result │ │ ◄─── result │ │ ◄─── result │
+                    └─────────────┘ └─────────────┘ └─────────────┘
+
+┌─────────────────────────────────────────────────────────────────┐
+│                        Key Benefits                             │
+├─────────────────────────────────────────────────────────────────┤
+│ ✓ Compile Once, Evaluate Many     ✓ Lock-Free Concurrent Eval   │
+│ ✓ No Re-parsing Overhead          ✓ Reference Counting Safety   │
+│ ✓ Reduced GC Pressure             ✓ Proper Resource Management  │
+│ ✓ Cache-Friendly Design           ✓ Target System Integration   │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## Key Features
+
+- **Pre-compiled Policies**: Compile once, evaluate many times for optimal performance
+- **Target System Support**: Built-in support for Azure Policy targets with resource type inference
+- **Thread Safety**: All operations are thread-safe without external synchronization
+- **Registry Management**: Centralized management of targets and schemas
+- **Policy Introspection**: Rich metadata about compiled policies
+
+## Core Classes
+
+### CompiledPolicy
+
+The `CompiledPolicy` class represents a pre-compiled Rego policy that can be evaluated efficiently.
+
+```csharp
+public sealed class CompiledPolicy : IDisposable
+{
+    // Evaluate the policy with input data
+    public string? EvalWithInput(string inputJson);
+    
+    // Get comprehensive policy metadata
+    public PolicyInfo GetPolicyInfo();
+    
+    // Dispose of unmanaged resources
+    public void Dispose();
+}
+```
+
+**Thread Safety**: All methods are thread-safe. Multiple threads can call `EvalWithInput()` concurrently, and `Dispose()` will safely wait for active evaluations to complete.
+
+### Compiler
+
+The `Compiler` class provides static methods for compiling policies.
+
+```csharp
+public static class Compiler
+{
+    // Compile a policy with a specific entrypoint rule
+    public static CompiledPolicy CompilePolicyWithEntrypoint(
+        string dataJson, 
+        IEnumerable<PolicyModule> modules, 
+        string entryPointRule);
+    
+    // Compile a target-aware policy (requires azure_policy feature)
+    public static CompiledPolicy CompilePolicyForTarget(
+        string dataJson, 
+        IEnumerable<PolicyModule> modules);
+}
+```
+
+### PolicyModule
+
+Represents a single policy module to be compiled. Each PolicyModule corresponds to a Rego file (.rego), and each Rego file defines a Rego package using the `package` declaration at the top of the file.
+
+```csharp
+public struct PolicyModule
+{
+    public string Id { get; set; }
+    public string Content { get; set; }
+    
+    public PolicyModule(string id, string content);
+}
+```
+
+**Properties:**
+- `Id`: A unique identifier for the module, typically the filename (e.g., "policy.rego", "rules/storage.rego")
+- `Content`: The complete Rego policy content, including the `package` declaration and all rules
+
+**Example:**
+```csharp
+var module = new PolicyModule("storage-policy.rego", @"
+    package azure.storage
+    import rego.v1
+    
+    default allow := false
+    allow if input.type == ""Microsoft.Storage/storageAccounts""
+");
+```
+
+### PolicyInfo
+
+Provides comprehensive metadata about a compiled policy.
+
+```csharp
+public class PolicyInfo
+{
+    // List of module identifiers
+    public List<string> ModuleIds { get; set; }
+    
+    // Target name (for target-aware policies)
+    public string? TargetName { get; set; }
+    
+    // Resource types this policy can evaluate
+    public List<string> ApplicableResourceTypes { get; set; }
+    
+    // Primary rule/entrypoint
+    public string EntrypointRule { get; set; }
+    
+    // Effect rule (for target-aware policies)
+    public string? EffectRule { get; set; }
+    
+    // Policy parameters
+    public List<PolicyParameters> Parameters { get; set; }
+}
+```
+
+## Registry Classes
+
+### TargetRegistry
+
+Manages target definitions for Azure Policy-style evaluations.
+
+```csharp
+public static class TargetRegistry
+{
+    // Register a target from JSON
+    public static void RegisterFromJson(string targetJson);
+    
+    // Check if a target exists
+    public static bool Contains(string name);
+    
+    // List all registered targets
+    public static string ListNames();
+    
+    // Remove a target
+    public static bool Remove(string name);
+    
+    // Clear all targets
+    public static void Clear();
+    
+    // Get count of registered targets
+    public static int Count { get; }
+    
+    // Check if registry is empty
+    public static bool IsEmpty { get; }
+}
+```
+
+### SchemaRegistry
+
+Manages schema definitions for validation.
+
+```csharp
+public static class SchemaRegistry
+{
+    // Register resource schemas
+    public static void RegisterResourceSchema(string name, string schemaJson);
+    public static bool ContainsResourceSchema(string name);
+    public static string ListResourceSchemas();
+    
+    // Register effect schemas
+    public static void RegisterEffectSchema(string name, string schemaJson);
+    public static bool ContainsEffectSchema(string name);
+    public static string ListEffectSchemas();
+    
+    // Clear methods
+    public static void ClearResourceSchemas();
+    public static void ClearEffectSchemas();
+}
+```
+
+## Usage Examples
+
+### Basic Policy Compilation and Evaluation
+
+```csharp
+// Define policy modules
+var modules = new List<PolicyModule>
+{
+    new PolicyModule("policy.rego", @"
+        package example
+        import rego.v1
+        
+        default allow := false
+        allow if input.user == ""admin""
+    ")
+};
+
+// Compile the policy
+using var policy = Compiler.CompilePolicyWithEntrypoint("{}", modules, "data.example.allow");
+
+// Evaluate with different inputs
+var result1 = policy.EvalWithInput(@"{""user"": ""admin""}");  // true
+var result2 = policy.EvalWithInput(@"{""user"": ""guest""}");  // false
+```
+
+### Target-Aware Policy (Azure Policy Style)
+
+```csharp
+// Register target definition
+TargetRegistry.RegisterFromJson(@"{
+    ""name"": ""azure.storage"",
+    ""resource_schema_selector"": ""type"",
+    ""resource_types"": {
+        ""Microsoft.Storage/storageAccounts"": {
+            ""schema"": { /* JSON Schema */ }
+        }
+    }
+}");
+
+// Define policy with target
+var modules = new List<PolicyModule>
+{
+    new PolicyModule("policy.rego", @"
+        package policy
+        import rego.v1
+        
+        __target__ := ""azure.storage""
+        
+        default effect := ""deny""
+        effect := ""allow"" if {
+            input.type == ""Microsoft.Storage/storageAccounts""
+            input.properties.supportsHttpsTrafficOnly == true
+        }
+    ")
+};
+
+// Compile for target
+using var policy = Compiler.CompilePolicyForTarget("{}", modules);
+
+// Evaluate Azure resource
+var resource = @"{
+    ""type"": ""Microsoft.Storage/storageAccounts"",
+    ""properties"": {
+        ""supportsHttpsTrafficOnly"": true
+    }
+}";
+
+var result = policy.EvalWithInput(resource);  // "allow"
+```
+
+### Policy Introspection
+
+```csharp
+// Get policy metadata
+var info = policy.GetPolicyInfo();
+
+Console.WriteLine($"Target: {info.TargetName}");
+Console.WriteLine($"Effect Rule: {info.EffectRule}");
+Console.WriteLine($"Modules: {string.Join(", ", info.ModuleIds)}");
+Console.WriteLine($"Resource Types: {string.Join(", ", info.ApplicableResourceTypes)}");
+
+// Access parameters
+if (info.Parameters != null && info.Parameters.Count > 0)
+{
+    foreach (var parameterSet in info.Parameters)
+    {
+        Console.WriteLine($"Module: {parameterSet.SourceFile}");
+        foreach (var param in parameterSet.Parameters)
+        {
+            Console.WriteLine($"Parameter: {param.Name} ({param.Type})");
+            if (param.Default != null)
+                Console.WriteLine($"  Default: {param.Default}");
+        }
+    }
+}
+```
+
+### Concurrent Evaluation
+
+```csharp
+// CompiledPolicy is thread-safe
+var tasks = Enumerable.Range(0, 100).Select(i => 
+    Task.Run(() => policy.EvalWithInput($@"{{""id"": {i}}}"))
+).ToArray();
+
+var results = await Task.WhenAll(tasks);
+```
+
+## Performance Considerations
+
+### Compilation Overhead
+
+- Policy compilation has significant overhead due to parsing and analysis
+- **Best Practice**: Compile once, reuse many times
+- Consider caching compiled policies for repeated use
+
+### Memory Management
+
+- `CompiledPolicy` manages unmanaged resources
+- **Always** dispose of compiled policies using `using` statements or explicit `Dispose()`
+- Disposal is thread-safe and waits for active evaluations
+
+### Thread Safety
+
+- All classes are thread-safe for concurrent reads/evaluations
+- Registry modifications should be done during initialization
+- No external synchronization required
+
+## Error Handling
+
+All methods throw `Exception` on errors with descriptive messages:
+
+```csharp
+try
+{
+    var policy = Compiler.CompilePolicyWithEntrypoint(data, modules, rule);
+    var result = policy.EvalWithInput(input);
+}
+catch (Exception ex)
+{
+    Console.WriteLine($"Error: {ex.Message}");
+}
+```
+
+## Feature Flags
+
+Some functionality requires specific Rust feature flags:
+
+- **azure_policy**: Required for target-aware compilation and policy parameters
+- Without this feature, target-related methods will not be available
+
+## Version Compatibility
+
+- Requires .NET Standard 2.0 or later
+- Compatible with .NET Framework 4.6.1+, .NET Core 2.0+, .NET 5+
+- Uses System.Text.Json for JSON serialization (added as dependency)
+
+## Best Practices
+
+1. **Compile Once, Evaluate Many**: Pre-compile policies for repeated evaluation
+2. **Use Disposable Pattern**: Always dispose of CompiledPolicy instances
+3. **Thread-Safe Design**: Take advantage of built-in thread safety
+4. **Registry Setup**: Configure targets and schemas during application startup
+5. **Error Handling**: Wrap operations in try-catch blocks for robust error handling
+6. **Performance Monitoring**: Monitor evaluation times for performance optimization
+
+## Migration from Engine-Based API
+
+If migrating from an engine-based approach:
+
+```csharp
+// Old approach (if it existed)
+// var engine = new Engine();
+// engine.AddPolicy("policy.rego", policyContent);
+// engine.SetInputJson(inputJson);
+// var result = engine.EvalRule("data.policy.allow");
+
+// New compiled approach
+var modules = new[] { new PolicyModule("policy.rego", policyContent) };
+using var policy = Compiler.CompilePolicyWithEntrypoint("{}", modules, "data.policy.allow");
+var result = policy.EvalWithInput(inputJson);
+```
+
+The compiled approach provides better performance for repeated evaluations and clearer resource management.

bindings/csharp/Benchmarks/Benchmarks.csproj

@@ -0,0 +1,25 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>Enable</Nullable>
+  </PropertyGroup>
+  
+  <PropertyGroup>
+    <!-- If the environment variable is set (such as in a Github Action run), append the suffix to the version number -->
+    <RegorusPackageVersionSuffix Condition="'$(VersionSuffix)' != ''">-$(VersionSuffix)</RegorusPackageVersionSuffix>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <!-- If the environment variable is set (such as in a Github Action run), append the suffix to the version number -->
+    <RegorusPackageVersionSuffix Condition="'$(VersionSuffix)' != ''">-$(VersionSuffix)</RegorusPackageVersionSuffix>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Regorus" Version="0.6.0$(RegorusPackageVersionSuffix)"/>
+  </ItemGroup>
+
+  <ItemGroup>
+    <None Include="../../ffi/target/release/libregorus_ffi.dylib" CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>
+</Project>

bindings/csharp/Benchmarks/CompiledPolicyEvaluationBenchmark.cs

@@ -0,0 +1,278 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Regorus;
+
+namespace Benchmarks
+{
+    public class CompiledPolicyEvaluationBenchmark
+    {
+        private static readonly string TestDataPath = Path.Combine(
+            Directory.GetCurrentDirectory(), 
+            "..", "..", "..",
+            "benches", "evaluation", "test_data"
+        );
+
+        private static readonly (string PolicyFile, string[] InputFiles)[] PolicyInputFiles = new[]
+        {
+            ("rbac_policy.rego", new[] { "rbac_input.json", "rbac_input2.json", "rbac_input3.json" }),
+            ("api_access_policy.rego", new[] { "api_access_input.json", "api_access_input2.json", "api_access_input3.json" }),
+            ("data_sensitivity_policy.rego", new[] { "data_sensitivity_input.json", "data_sensitivity_input2.json", "data_sensitivity_input3.json" }),
+            ("time_based_policy.rego", new[] { "time_based_input.json", "time_based_input2.json", "time_based_input3.json" }),
+            ("data_processing_policy.rego", new[] { "data_processing_input.json", "data_processing_input2.json", "data_processing_input3.json" }),
+            ("azure_vm_policy.rego", new[] { "azure_vm_input.json", "azure_vm_input2.json", "azure_vm_input3.json" }),
+            ("azure_storage_policy.rego", new[] { "azure_storage_input.json", "azure_storage_input2.json", "azure_storage_input3.json" }),
+            ("azure_keyvault_policy.rego", new[] { "azure_keyvault_input.json", "azure_keyvault_input2.json", "azure_keyvault_input3.json" }),
+            ("azure_nsg_policy.rego", new[] { "azure_nsg_input.json", "azure_nsg_input2.json", "azure_nsg_input3.json" })
+        };
+
+        private static readonly string[] PolicyNames = new[]
+        {
+            "rbac_policy",
+            "api_access_policy", 
+            "data_sensitivity_policy",
+            "time_based_policy",
+            "data_processing_policy",
+            "azure_vm_policy",
+            "azure_storage_policy",
+            "azure_keyvault_policy",
+            "azure_nsg_policy"
+        };
+
+        private static List<(string Policy, string[] Inputs)> LoadPoliciesWithInputs()
+        {
+            var result = new List<(string Policy, string[] Inputs)>();
+            
+            foreach (var (policyFile, inputFiles) in PolicyInputFiles)
+            {
+                var policyPath = Path.Combine(TestDataPath, "policies", policyFile);
+                var policy = File.ReadAllText(policyPath);
+                
+                var inputs = inputFiles.Select(inputFile =>
+                {
+                    var inputPath = Path.Combine(TestDataPath, "inputs", inputFile);
+                    return File.ReadAllText(inputPath);
+                }).ToArray();
+                
+                result.Add((policy, inputs));
+            }
+            
+            return result;
+        }
+
+        private static List<CompiledPolicy> PrepareSharedCompiledPolicies()
+        {
+            var policiesWithInputs = LoadPoliciesWithInputs();
+            var compiledPolicies = new List<CompiledPolicy>();
+            
+            foreach (var (policy, _) in policiesWithInputs)
+            {
+                var modules = new[] { new PolicyModule { Id = "policy.rego", Content = policy } };
+                var compiled = Compiler.CompilePolicyWithEntrypoint("{}", modules, "data.bench.allow");
+                compiledPolicies.Add(compiled);
+            }
+            
+            return compiledPolicies;
+        }
+
+        public static void RunCompiledPolicyEvaluationBenchmark()
+        {
+            var cpuCount = Environment.ProcessorCount;
+            var maxThreads = cpuCount * 2;
+            var threadCounts = new List<int> { 1, 2 };
+            
+            // Add even numbers from 4 to maxThreads
+            for (int i = 4; i <= maxThreads; i += 2)
+            {
+                threadCounts.Add(i);
+            }
+            
+            Console.WriteLine($"Running compiled policy benchmark with max_threads: {maxThreads}");
+            Console.WriteLine($"Testing with thread counts: {string.Join(", ", threadCounts)}");
+            Console.WriteLine();
+
+            // Benchmark both shared policies and per-iteration compilation
+            var configurations = new[]
+            {
+                (true, "compiled_shared_policies"),
+                (false, "compiled_per_iteration")
+            };
+
+            foreach (var (useSharedPolicies, groupName) in configurations)
+            {
+                Console.WriteLine($"=== {groupName} ===");
+
+                foreach (var threads in threadCounts)
+                {
+                    RunCompiledPolicyBenchmark(threads, useSharedPolicies, groupName);
+                }
+                Console.WriteLine();
+            }
+        }
+
+        public static void RunCompiledPolicyBenchmark(int threads, bool useSharedPolicies, string groupName)
+        {
+            const int warmupSeconds = 3;
+            const int durationSeconds = 3;
+            var policiesWithInputs = LoadPoliciesWithInputs();
+            List<CompiledPolicy>? compiledPolicies = null;
+            
+            if (useSharedPolicies)
+            {
+                compiledPolicies = PrepareSharedCompiledPolicies();
+            }
+            
+            Console.WriteLine($"Warming up with {threads} threads for {warmupSeconds} seconds...");
+            
+            // Warmup phase
+            var (_, _, _) = RunBenchmarkPhase(threads, warmupSeconds, policiesWithInputs, compiledPolicies, useSharedPolicies, isWarmup: true);
+            
+            Console.WriteLine($"Running benchmark with {threads} threads for {durationSeconds} seconds...");
+            
+            // Actual benchmark phase
+            var (totalEvaluations, evaluationTime, policyCounters) = RunBenchmarkPhase(threads, durationSeconds, policiesWithInputs, compiledPolicies, useSharedPolicies, isWarmup: false);
+
+            // Calculate throughput based on pure evaluation time (consistent with Rust benchmark)
+            var evalsPerSecond = totalEvaluations / evaluationTime.TotalSeconds;
+            var kelemsPerSecond = evalsPerSecond / 1000.0;
+
+            Console.WriteLine($"{groupName}/eval/{threads} threads");
+            Console.WriteLine($"                        time:   [{evaluationTime.TotalMilliseconds:F2} ms]");
+            Console.WriteLine($"                        thrpt:  [{kelemsPerSecond:F2} Kelem/s]");
+
+            // Clean up compiled policies if we created them
+            if (compiledPolicies != null)
+            {
+                foreach (var policy in compiledPolicies)
+                {
+                    policy.Dispose();
+                }
+            }
+
+            // Verify that all policies were evaluated
+            var allEvaluated = policyCounters.Values.All(count => count > 0);
+
+            if (allEvaluated)
+            {
+                Console.WriteLine("✓ All policies were evaluated successfully");
+            }
+            else
+            {
+                Console.WriteLine("ERROR: Some policies were never evaluated successfully!");
+            }
+        }
+
+        private static (int totalEvaluations, TimeSpan evaluationTime, Dictionary<string, int> policyCounters) RunBenchmarkPhase(
+            int threads, 
+            int durationSeconds, 
+            List<(string Policy, string[] Inputs)> policiesWithInputs,
+            List<CompiledPolicy>? compiledPolicies,
+            bool useSharedPolicies,
+            bool isWarmup)
+        {
+            var barrier = new Barrier(threads);
+            var tasks = new Task[threads];
+            var policyCounters = new Dictionary<string, int>();
+            var evaluationTimes = new Dictionary<int, TimeSpan>();
+            var lockObject = new object();
+            var stopExecution = false;
+
+            // Initialize counters
+            foreach (var policyName in PolicyNames)
+            {
+                policyCounters[policyName] = 0;
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+
+            for (int threadId = 0; threadId < threads; threadId++)
+            {
+                int tid = threadId;
+                tasks[threadId] = Task.Run(() =>
+                {
+                    barrier.SignalAndWait();
+                    
+                    int evaluationCount = 0;
+                    var localEvaluationTime = TimeSpan.Zero;
+                    
+                    while (!stopExecution)
+                    {
+                        // Use different policy for each iteration
+                        int policyIdx = (tid + evaluationCount) % policiesWithInputs.Count;
+                        var (policy, inputs) = policiesWithInputs[policyIdx];
+
+                        // Use different input for the same policy based on iteration
+                        int inputIdx = evaluationCount % inputs.Length;
+                        var input = inputs[inputIdx];
+
+                        try
+                        {
+                            // Measure only the evaluation call
+                            var evalStopwatch = Stopwatch.StartNew();
+                            
+                            if (useSharedPolicies)
+                            {
+                                var result = compiledPolicies![policyIdx].EvalWithInput(input);
+                            }
+                            else
+                            {
+                                // Compile policy in each iteration
+                                var modules = new[] { new PolicyModule { Id = "policy.rego", Content = policy } };
+                                var compiled = Compiler.CompilePolicyWithEntrypoint("{}", modules, "data.bench.allow");
+                                var result = compiled.EvalWithInput(input);
+                                compiled.Dispose();
+                            }
+                            
+                            evalStopwatch.Stop();
+                            localEvaluationTime += evalStopwatch.Elapsed;
+                            
+                            // Track successful evaluations (only during actual benchmark, not warmup)
+                            if (!isWarmup)
+                            {
+                                lock (lockObject)
+                                {
+                                    policyCounters[PolicyNames[policyIdx]]++;
+                                }
+                            }
+                        }
+                        catch (Exception)
+                        {
+                            // Ignore evaluation errors for benchmarking purposes
+                        }
+                        
+                        evaluationCount++;
+                    }
+                    
+                    // Store the actual evaluation time for this thread
+                    if (!isWarmup)
+                    {
+                        lock (lockObject)
+                        {
+                            if (!evaluationTimes.ContainsKey(tid))
+                                evaluationTimes[tid] = TimeSpan.Zero;
+                            evaluationTimes[tid] = localEvaluationTime;
+                        }
+                    }
+                });
+            }
+
+            // Stop execution after the specified duration
+            Task.Delay(TimeSpan.FromSeconds(durationSeconds)).ContinueWith(_ => stopExecution = true);
+
+            Task.WaitAll(tasks);
+            stopwatch.Stop();
+
+            var totalEvaluations = policyCounters.Values.Sum();
+            var totalEvaluationTime = evaluationTimes.Values.Aggregate(TimeSpan.Zero, (sum, time) => sum + time);
+            
+            // Use pure evaluation time (consistent with Rust benchmark)
+            var evaluationTime = totalEvaluationTime == TimeSpan.Zero ? stopwatch.Elapsed : totalEvaluationTime;
+            
+            return (totalEvaluations, evaluationTime, policyCounters);
+        }
+    }
+}

bindings/csharp/Benchmarks/EngineEvaluationBenchmark.cs

@@ -0,0 +1,293 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Regorus;
+
+namespace Benchmarks
+{
+    public class EngineEvaluationBenchmark
+    {
+        private static readonly string TestDataPath = Path.Combine(
+            Directory.GetCurrentDirectory(), 
+            "..", "..", "..",
+            "benches", "evaluation", "test_data"
+        );
+
+        private static readonly (string PolicyFile, string[] InputFiles)[] PolicyInputFiles = new[]
+        {
+            ("rbac_policy.rego", new[] { "rbac_input.json", "rbac_input2.json", "rbac_input3.json" }),
+            ("api_access_policy.rego", new[] { "api_access_input.json", "api_access_input2.json", "api_access_input3.json" }),
+            ("data_sensitivity_policy.rego", new[] { "data_sensitivity_input.json", "data_sensitivity_input2.json", "data_sensitivity_input3.json" }),
+            ("time_based_policy.rego", new[] { "time_based_input.json", "time_based_input2.json", "time_based_input3.json" }),
+            ("data_processing_policy.rego", new[] { "data_processing_input.json", "data_processing_input2.json", "data_processing_input3.json" }),
+            ("azure_vm_policy.rego", new[] { "azure_vm_input.json", "azure_vm_input2.json", "azure_vm_input3.json" }),
+            ("azure_storage_policy.rego", new[] { "azure_storage_input.json", "azure_storage_input2.json", "azure_storage_input3.json" }),
+            ("azure_keyvault_policy.rego", new[] { "azure_keyvault_input.json", "azure_keyvault_input2.json", "azure_keyvault_input3.json" }),
+            ("azure_nsg_policy.rego", new[] { "azure_nsg_input.json", "azure_nsg_input2.json", "azure_nsg_input3.json" })
+        };
+
+        private static readonly string[] PolicyNames = new[]
+        {
+            "rbac_policy",
+            "api_access_policy", 
+            "data_sensitivity_policy",
+            "time_based_policy",
+            "data_processing_policy",
+            "azure_vm_policy",
+            "azure_storage_policy",
+            "azure_keyvault_policy",
+            "azure_nsg_policy"
+        };
+
+        private static List<(string Policy, string[] Inputs)> LoadPoliciesWithInputs()
+        {
+            var result = new List<(string Policy, string[] Inputs)>();
+            
+            foreach (var (policyFile, inputFiles) in PolicyInputFiles)
+            {
+                var policyPath = Path.Combine(TestDataPath, "policies", policyFile);
+                var policy = File.ReadAllText(policyPath);
+                
+                var inputs = inputFiles.Select(inputFile =>
+                {
+                    var inputPath = Path.Combine(TestDataPath, "inputs", inputFile);
+                    return File.ReadAllText(inputPath);
+                }).ToArray();
+                
+                result.Add((policy, inputs));
+            }
+            
+            return result;
+        }
+
+        private static List<Engine> PrepareClonedEngines()
+        {
+            var policiesWithInputs = LoadPoliciesWithInputs();
+            var engines = new List<Engine>();
+            
+            foreach (var (policy, _) in policiesWithInputs)
+            {
+                var engine = new Engine();
+                engine.AddPolicy("policy.rego", policy);
+                
+                // Warm up the engine to ensure it's fully prepared for evaluation
+                // This prevents each cloned engine from repeating preparation work
+                engine.SetInputJson("{}");
+                try
+                {
+                    engine.EvalRule("data.bench.allow");
+                }
+                catch
+                {
+                    // Ignore warmup errors
+                }
+                
+                engines.Add(engine);
+            }
+            
+            return engines;
+        }
+
+        public static void RunEngineEvaluationBenchmark()
+        {
+            var cpuCount = Environment.ProcessorCount;
+            var maxThreads = cpuCount * 2;
+            var threadCounts = new List<int> { 1, 2 };
+            
+            // Add even numbers from 4 to maxThreads
+            for (int i = 4; i <= maxThreads; i += 2)
+            {
+                threadCounts.Add(i);
+            }
+            
+            Console.WriteLine($"Running engine benchmark with max_threads: {maxThreads}");
+            Console.WriteLine($"Testing with thread counts: {string.Join(", ", threadCounts)}");
+            Console.WriteLine();
+
+            // Benchmark both cloned engines and fresh engines
+            var configurations = new[]
+            {
+                (true, "cloned_engines"),
+                (false, "fresh_engines")
+            };
+
+            foreach (var (useClonedEngines, groupName) in configurations)
+            {
+                Console.WriteLine($"=== {groupName} ===");
+
+                foreach (var threads in threadCounts)
+                {
+                    RunEngineEvaluationBenchmark(threads, useClonedEngines, groupName);
+                }
+                Console.WriteLine();
+            }
+        }
+
+        public static void RunEngineEvaluationBenchmark(int threads, bool useClonedEngines, string groupName)
+        {
+            const int warmupSeconds = 3;
+            const int durationSeconds = 3;
+            var policiesWithInputs = LoadPoliciesWithInputs();
+            
+            Console.WriteLine($"Warming up with {threads} threads for {warmupSeconds} seconds...");
+            
+            // Warmup phase
+            var (_, _, _) = RunBenchmarkPhase(threads, warmupSeconds, policiesWithInputs, useClonedEngines, isWarmup: true);
+            
+            Console.WriteLine($"Running benchmark with {threads} threads for {durationSeconds} seconds...");
+            
+            // Actual benchmark phase
+            var (totalEvaluations, evaluationTime, policyCounters) = RunBenchmarkPhase(threads, durationSeconds, policiesWithInputs, useClonedEngines, isWarmup: false);
+
+            // Calculate throughput based on pure evaluation time (consistent with Rust benchmark)
+            var evalsPerSecond = totalEvaluations / evaluationTime.TotalSeconds;
+            var kelemsPerSecond = evalsPerSecond / 1000.0;
+
+            Console.WriteLine($"{groupName}/eval/{threads} threads");
+            Console.WriteLine($"                        time:   [{evaluationTime.TotalMilliseconds:F2} ms]");
+            Console.WriteLine($"                        thrpt:  [{kelemsPerSecond:F2} Kelem/s]");
+
+            // Verify that all policies were evaluated
+            var allEvaluated = policyCounters.Values.All(count => count > 0);
+
+            if (allEvaluated)
+            {
+                Console.WriteLine("✓ All policies were evaluated successfully");
+            }
+            else
+            {
+                Console.WriteLine("ERROR: Some policies were never evaluated successfully!");
+            }
+        }
+
+        private static (int totalEvaluations, TimeSpan evaluationTime, Dictionary<string, int> policyCounters) RunBenchmarkPhase(
+            int threads, 
+            int durationSeconds, 
+            List<(string Policy, string[] Inputs)> policiesWithInputs,
+            bool useClonedEngines,
+            bool isWarmup)
+        {
+            var barrier = new Barrier(threads);
+            var tasks = new Task[threads];
+            var policyCounters = new Dictionary<string, int>();
+            var evaluationTimes = new Dictionary<int, TimeSpan>();
+            var lockObject = new object();
+            var stopExecution = false;
+
+            // Initialize counters
+            foreach (var policyName in PolicyNames)
+            {
+                policyCounters[policyName] = 0;
+            }
+
+            // Pre-create engines if using cloned engines
+            List<Engine>? clonedEngines = null;
+            if (useClonedEngines)
+            {
+                clonedEngines = PrepareClonedEngines();
+            }
+
+            var stopwatch = Stopwatch.StartNew();
+
+            for (int threadId = 0; threadId < threads; threadId++)
+            {
+                int tid = threadId;
+                tasks[threadId] = Task.Run(() =>
+                {
+                    barrier.SignalAndWait();
+                    
+                    int evaluationCount = 0;
+                    var localEvaluationTime = TimeSpan.Zero;
+                    
+                    while (!stopExecution)
+                    {
+                        // Use different policy for each iteration
+                        int policyIdx = (tid + evaluationCount) % policiesWithInputs.Count;
+                        var (policy, inputs) = policiesWithInputs[policyIdx];
+
+                        // Use different input for the same policy based on iteration
+                        int inputIdx = evaluationCount % inputs.Length;
+                        var input = inputs[inputIdx];
+
+                        try
+                        {
+                            // Measure only the engine operations
+                            var evalStopwatch = Stopwatch.StartNew();
+                            
+                            Engine engine;
+                            if (useClonedEngines)
+                            {
+                                engine = clonedEngines![policyIdx].Clone();
+                            }
+                            else
+                            {
+                                engine = new Engine();
+                                engine.AddPolicy("policy.rego", policy);
+                            }
+                            
+                            engine.SetInputJson(input);
+                            var result = engine.EvalRule("data.bench.allow");
+                            engine.Dispose();
+                            
+                            evalStopwatch.Stop();
+                            localEvaluationTime += evalStopwatch.Elapsed;
+                            
+                            // Track successful evaluations (only during actual benchmark, not warmup)
+                            if (!isWarmup)
+                            {
+                                lock (lockObject)
+                                {
+                                    policyCounters[PolicyNames[policyIdx]]++;
+                                }
+                            }
+                        }
+                        catch (Exception)
+                        {
+                            // Ignore evaluation errors for benchmarking purposes
+                        }
+                        
+                        evaluationCount++;
+                    }
+                    
+                    // Store the actual evaluation time for this thread
+                    if (!isWarmup)
+                    {
+                        lock (lockObject)
+                        {
+                            if (!evaluationTimes.ContainsKey(tid))
+                                evaluationTimes[tid] = TimeSpan.Zero;
+                            evaluationTimes[tid] = localEvaluationTime;
+                        }
+                    }
+                });
+            }
+
+            // Stop execution after the specified duration
+            Task.Delay(TimeSpan.FromSeconds(durationSeconds)).ContinueWith(_ => stopExecution = true);
+
+            Task.WaitAll(tasks);
+            stopwatch.Stop();
+
+            // Clean up cloned engines if we created them
+            if (clonedEngines != null)
+            {
+                foreach (var engine in clonedEngines)
+                {
+                    engine.Dispose();
+                }
+            }
+
+            var totalEvaluations = policyCounters.Values.Sum();
+            var totalEvaluationTime = evaluationTimes.Values.Aggregate(TimeSpan.Zero, (sum, time) => sum + time);
+            
+            // Use pure evaluation time (consistent with Rust benchmark)
+            var evaluationTime = totalEvaluationTime == TimeSpan.Zero ? stopwatch.Elapsed : totalEvaluationTime;
+            
+            return (totalEvaluations, evaluationTime, policyCounters);
+        }
+    }
+}

bindings/csharp/Benchmarks/Program.cs

@@ -0,0 +1,36 @@
+using System;
+
+namespace Benchmarks
+{
+    class Program
+    {
+        static void Main(string[] args)
+        {
+            Console.WriteLine("=== Regorus C# Benchmarks ===\n");
+            
+            try
+            {
+                Console.WriteLine("Running Engine Evaluation Benchmark...");
+                EngineEvaluationBenchmark.RunEngineEvaluationBenchmark();
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine($"Engine benchmark failed: {ex.Message}");
+            }
+            
+            Console.WriteLine("\n" + new string('=', 80) + "\n");
+            
+            try
+            {
+                Console.WriteLine("Running Compiled Policy Evaluation Benchmark...");
+                CompiledPolicyEvaluationBenchmark.RunCompiledPolicyEvaluationBenchmark();
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine($"Compiled policy benchmark failed: {ex.Message}");
+            }
+            
+            Console.WriteLine("\n=== Benchmarks Complete ===");
+        }
+    }
+}

bindings/csharp/Benchmarks/compiled_policy_evaluation_benchmark.md

@@ -0,0 +1,103 @@
+# Compiled Policy Evaluation Benchmark Results (C#/.NET)
+
+## Test Environment
+- **Platform**: Apple Silicon (M-Series)
+- **CPU**: 16 cores
+- **Architecture**: ARM64 (aarch64-apple-darwin)
+- **.NET Version**: 8.0
+- **Benchmark Framework**: Custom time-based benchmarking
+- **Test Data**: 20,000 inputs per evaluation (distributed across threads)
+- **Policy**: Complex authorization policy with nested rules
+- **Warmup Duration**: 3 seconds per configuration
+- **Evaluation Duration**: 3 seconds per configuration
+
+## Benchmark Overview
+
+The C# compiled policy evaluation benchmark tests Regorus compiled policy performance across multiple thread configurations (1-32 threads). It measures throughput (thousands of evaluations per second) for different combinations of compiled policy compilation strategies.
+
+## Configuration Combinations
+
+1. **Compiled Shared Policies**: All threads share pre-compiled policy instances - optimal for performance
+2. **Compiled Per Iteration**: Each thread compiles the policy for each evaluation iteration
+
+*Note: The C# implementation uses a simpler configuration model compared to Rust, which also varies input data handling (cloned vs fresh inputs). The C# benchmarks focus on compilation strategies with consistent input handling.*
+
+## Performance Results
+
+### Compiled Shared Policies (Best Performance)
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                    2928.81 |                  211 |
+|       2 |                    5892.53 |                  146 |
+|       4 |                   11750.71 |                  155 |
+|       6 |                   17686.92 |                  134 |
+|       8 |                   23543.53 |                   90 |
+|      10 |                   29503.80 |                   72 |
+|      12 |                   35494.81 |                   58 |
+|      14 |                   41408.36 |                   50 |
+|      16 |                   47333.65 |                   44 |
+|      18 |                   53050.24 |                   38 |
+|      20 |                   58807.20 |                   34 |
+|      22 |                  406022.45 |                   32 |
+|      24 |                   65480.69 |                   32 |
+|      26 |                   70952.34 |                   30 |
+|      28 |                   72064.03 |                   30 |
+|      30 |                  492405.74 |                   27 |
+|      32 |                   81210.83 |                   27 |
+
+### Compiled Per Iteration
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                    2984.00 |                   39 |
+|       2 |                    5969.45 |                   38 |
+|       4 |                   11948.28 |                   32 |
+|       6 |                   17927.24 |                   30 |
+|       8 |                   23889.01 |                   24 |
+|      10 |                   29882.38 |                   20 |
+|      12 |                   35865.06 |                   18 |
+|      14 |                   41838.70 |                   15 |
+|      16 |                   47800.92 |                   14 |
+|      18 |                   53257.22 |                   10 |
+|      20 |                   59596.93 |                   11 |
+|      22 |                  435853.41 |                   10 |
+|      24 |                   70870.86 |                    9 |
+|      26 |                   76120.59 |                    9 |
+|      28 |                   80717.51 |                    8 |
+|      30 |                  544207.96 |                    8 |
+|      32 |                   91540.91 |                    7 |
+
+## Analysis
+
+The C# compiled policy benchmark demonstrates important performance characteristics:
+
+1. **Compilation Strategy Impact**: Shared compiled policies significantly outperform per-iteration compilation (~5.4x at 1 thread)
+2. **Scaling Patterns**: 
+   - Best throughput achieved at 1 thread for shared policies
+   - Performance generally degrades with increased thread count
+3. **Performance Hierarchy**:
+   - Shared compiled policies: Best performance (optimal configuration)
+   - Per-iteration compilation: ~82% reduction from optimal
+4. **Compilation Overhead**: Per-iteration compilation creates substantial overhead, similar to fresh engine creation
+5. **Thread Contention**: Significant performance degradation beyond 8 threads for both configurations
+
+## Comparison with Rust Compiled Policy Evaluation
+
+| Configuration    | C# Performance (1 thread)  | Rust Performance (1 thread) | Relative Performance |
+|:-----------------|:----------------------------|:-----------------------------|---------------------:|
+| Shared Policies  | Best performance            | Higher throughput            |          0.40x-0.70x |
+| Per-iteration    | ~82% reduction from optimal | ~85% reduction from optimal  |          0.47x-0.89x |
+
+*Note: Rust benchmarks include additional input data variations (cloned vs fresh inputs) that are not present in the C# implementation.*
+
+## Comparison with C# Engine Evaluation
+
+| Configuration  | Compiled Policy (1 thread) | Engine Evaluation (1 thread) | Performance Ratio |
+|:---------------|:----------------------------|:------------------------------|------------------:|
+| Optimal Config | Best performance            | Slightly higher throughput    |              0.96x |
+
+## Performance Insights
+
+1. **Compilation Efficiency**: Pre-compiled policies provide massive performance benefits over per-iteration compilation
+2. **C# Performance Gap**: C# compiled policies achieve 40%-70% of Rust performance for shared policies
+3. **Engine vs Compiled**: In C#, engine evaluation slightly outperforms compiled policies (96%-104% range)
+

bindings/csharp/Benchmarks/engine_evaluation_benchmark.md

@@ -0,0 +1,99 @@
+# Engine Evaluation Benchmark Results (C#/.NET)
+
+## Test Environment
+- **Platform**: Apple Silicon (M-Series)
+- **CPU**: 16 cores
+- **Architecture**: ARM64 (aarch64-apple-darwin)
+- **.NET Version**: 8.0
+- **Benchmark Framework**: Custom time-based benchmarking
+- **Test Data**: 20,000 inputs per evaluation (distributed across threads)
+- **Policy**: Complex authorization policy with nested rules
+- **Warmup Duration**: 3 seconds per configuration
+- **Evaluation Duration**: 3 seconds per configuration
+
+## Benchmark Overview
+
+The C# engine evaluation benchmark tests Regorus policy evaluation performance across multiple thread configurations (1-32 threads). It measures throughput (thousands of evaluations per second) for different combinations of engine reuse strategies.
+
+## Configuration Combinations
+
+1. **Cloned Engines**: Each thread uses its own cloned engine instance - optimal for performance
+2. **Fresh Engines**: Each thread creates a new engine for each evaluation iteration
+
+*Note: The C# implementation uses a simpler configuration model compared to Rust, which also varies input data handling (cloned vs fresh inputs). The C# benchmarks focus on engine reuse strategies with consistent input handling.*
+
+## Performance Results
+
+### Cloned Engines (Best Performance)
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                    2930.56 |                  219 |
+|       2 |                    5868.46 |                  177 |
+|       4 |                   11771.01 |                  146 |
+|       6 |                   17682.52 |                  129 |
+|       8 |                   23633.65 |                   78 |
+|      10 |                   29489.12 |                   67 |
+|      12 |                   35455.23 |                   57 |
+|      14 |                   41353.65 |                   47 |
+|      16 |                   47378.91 |                   42 |
+|      18 |                   52750.68 |                   36 |
+|      20 |                   58131.31 |                   35 |
+|      22 |                   62964.88 |                   31 |
+|      24 |                   64337.75 |                   34 |
+|      26 |                   70044.96 |                   29 |
+|      28 |                   72553.98 |                   28 |
+|      30 |                   79323.25 |                   26 |
+|      32 |                   78624.33 |                   26 |
+
+### Fresh Engines
+| Threads | Total Evaluation Time (ms) | Throughput (Kelem/s) |
+|--------:|---------------------------:|---------------------:|
+|       1 |                    2985.49 |                   41 |
+|       2 |                    5968.13 |                   38 |
+|       4 |                   11942.10 |                   34 |
+|       6 |                   17918.75 |                   32 |
+|       8 |                   23873.57 |                   25 |
+|      10 |                   29863.85 |                   20 |
+|      12 |                   35823.98 |                   19 |
+|      14 |                   41811.53 |                   16 |
+|      16 |                   47819.89 |                   14 |
+|      18 |                   53478.32 |                   13 |
+|      20 |                   59191.93 |                   12 |
+|      22 |                   64630.71 |                   11 |
+|      24 |                   70215.54 |                   10 |
+|      26 |                   75732.06 |                    9 |
+|      28 |                   80897.59 |                    9 |
+|      30 |                  949904.84 |                    8 |
+|      32 |                   92592.64 |                    8 |
+
+## Analysis
+
+The C# benchmark results demonstrate important performance characteristics:
+
+1. **Engine Reuse Impact**: Cloned engines significantly outperform fresh engines (~5.3x at 1 thread)
+2. **Scaling Patterns**: 
+   - Best throughput achieved at 1 thread for both configurations
+   - Performance degrades with increased thread count due to contention
+   - Cloned engines show better relative scaling characteristics
+3. **Performance Hierarchy**: 
+   - Cloned engines: Best performance (optimal configuration)
+   - Fresh engines: ~81% reduction from optimal
+4. **Thread Contention**: Significant performance drop beyond 8 threads, especially for fresh engines
+5. **C# vs Rust Performance**: C# shows ~67% of Rust performance for equivalent cloned engine configuration
+
+## Comparison with Rust Engine Evaluation
+
+| Configuration  | C# Performance (1 thread) | Rust Performance (1 thread) | Relative Performance |
+|:---------------|:---------------------------|:-----------------------------|---------------------:|
+| Cloned Engines | Best performance           | Higher throughput            |          0.67x-0.92x |
+| Fresh Engines  | ~81% reduction from optimal| ~87% reduction from optimal  |          0.75x-0.95x |
+
+*Note: Rust benchmarks include additional input data variations (cloned vs fresh inputs) that are not present in the C# implementation.*
+
+## Performance Insights
+
+1. **Engine Creation Overhead**: Fresh engine creation has massive performance impact in C# (~5.3x slower)
+2. **Thread Scaling**: C# shows more significant thread contention than Rust implementation
+3. **Memory Management**: .NET garbage collection may contribute to performance variations
+4. **Interop Overhead**: C# bindings add measurable overhead compared to native Rust
+

bindings/csharp/Program.cs

@@ -1,58 +0,0 @@
-using System.Diagnostics;
-
-long nanosecPerTick = (1000L*1000L*1000L) / Stopwatch.Frequency;
-var w = new Stopwatch();
-
-
-// Force load of modules.
-{
-    var _e = new Regorus.Engine();
-    var _j = System.Text.Json.JsonDocument.Parse("{}");
-}
-
-w.Restart();
-
-var engine = new Regorus.Engine();
-
-w.Stop();
-var newEngineTicks = w.ElapsedTicks;
-
-
-w.Restart();
-
-// Load policies and data.
-engine.AddPolicyFromFile("../../tests/aci/framework.rego");
-engine.AddPolicyFromFile("../../tests/aci/api.rego");
-engine.AddPolicyFromFile("../../tests/aci/policy.rego");
-engine.AddDataFromJsonFile("../../tests/aci/data.json");
-
-
-w.Stop();
-var loadPoliciesTicks = w.ElapsedTicks;
-
-
-w.Restart();
-
-// Set input and eval rule.
-engine.SetInputFromJsonFile("../../tests/aci/input.json");
-var value = engine.EvalQuery("data.framework.mount_overlay");
-var valueDoc = System.Text.Json.JsonDocument.Parse(value);
-
-w.Stop();
-var evalTicks = w.ElapsedTicks;
-
-Console.WriteLine("{0}", valueDoc);
-
-
-Console.WriteLine("Engine creation took {0} msecs", (newEngineTicks*nanosecPerTick)/(1000.0*1000.0));
-Console.WriteLine("Load policies and data took {0} msecs", (loadPoliciesTicks*nanosecPerTick)/(1000.0*1000.0));
-Console.WriteLine("EvalQuery took {0} msecs", (evalTicks*nanosecPerTick)/(1000.0*1000.0));
-
-engine = new Regorus.Engine();
-engine.AddPolicy(
-  "test.rego", 
-  "package test\nx = 1\nmessage = `Hello`");
-
-engine.SetEnableCoverage(true);
-Console.WriteLine("{0}", engine.EvalRule("data.test.message"));
-Console.WriteLine("{0}", engine.GetCoverageReportPretty());

bindings/csharp/README.md

@@ -0,0 +1,32 @@
+# Regorus CSharp
+
+**Regorus** is
+
+  - *Rego*-*Rus(t)*  - A fast, light-weight [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/)
+   interpreter written in Rust.
+  - *Rigorous* - A rigorous enforcer of well-defined Rego semantics.
+
+See main [Regorus page](https://github.com/microsoft/regorus) for more details about the project.
+
+# Building
+
+## Github Actions
+
+The simplest way to build a Nuget for Regorus' C# bindings is to use Github Actions. The action to do so is named `bindings/csharp` and is defined in `.github/workflows/test-csharp.yml`.
+
+There are two ways to trigger a Nuget build.
+1. Runs are triggered automatically whenever a push or pull request is made to the `main` branch.
+2. A run can be triggered manually by navigating to the action in the Github UI and clicking `Run workflow`. This option allows you to generate a Nuget for any branch, which is useful when testing the integration of in-progress changes to Regorus with other projects. Nuget files that are generated via this flow will have a `manualtrigger` suffix appended to their version number, making it easy to distinguish them from Nugets generated using the `main` branch.
+![Image displaying the run workflow button](docs/images/readme/manuallytriggeringrun.png)
+
+Once the workflow run completes, the generated Nuget can be downloaded by following these steps:
+1. Open the run.
+2. Click on `Build Regorus nuget` on the left.
+3. Expand the `Upload Regorus nuget` step.
+4. Click the `Artifact download URL` link at the bottom.
+5. Save and extract the downloaded zip file to find the `.nupkg` file.
+![Image displaying the download URL link](docs/images/readme/downloadnuget.png)
+
+## Local
+
+TODO

bindings/csharp/Regorus.Tests/Regorus.Tests.csproj

@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Nullable>Enable</Nullable>
+    <TargetFramework>net8.0</TargetFramework>
+    <EnableMSTestRunner>true</EnableMSTestRunner>
+    <!-- More info about dotnet test integration https://learn.microsoft.com/dotnet/core/testing/unit-testing-platform-integration-dotnet-test -->
+    <TestingPlatformDotnetTestSupport>true</TestingPlatformDotnetTestSupport>
+    <TestingPlatformShowTestsFailure>true</TestingPlatformShowTestsFailure>
+  </PropertyGroup>
+  
+  <PropertyGroup>
+    <!-- If the environment variable is set (such as in a Github Action run), append the suffix to the version number -->
+    <RegorusPackageVersionSuffix Condition="'$(VersionSuffix)' != ''">-$(VersionSuffix)</RegorusPackageVersionSuffix>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Include="../../../tests/**/*.*" Link="tests/%(RecursiveDir)%(Filename)%(Extension)" CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="MSTest" Version="3.8.2" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Regorus" Version="0.6.0$(RegorusPackageVersionSuffix)"/>
+  </ItemGroup>
+</Project>

bindings/csharp/Regorus.Tests/RegorusTests.cs

@@ -0,0 +1,215 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+namespace Regorus.Tests;
+
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using System.Text.Json.Nodes;
+
+[TestClass]
+public class RegorusTests
+{
+    [TestMethod]
+    public void Basic_evaluation_succeeds()
+    {
+        using var engine = new Engine();
+        engine.AddPolicy(
+            "test.rego",
+            "package test\nx = 1\nmessage = `Hello`");
+
+        var result = engine.EvalRule("data.test.message");
+
+        Assert.AreEqual("\"Hello\"", result);
+    }
+
+    [TestMethod]
+    public void Evaluation_using_file_policies_succeeds()
+    {
+        using var engine = new Engine();
+        engine.SetRegoV0(true);
+
+        // Load policies and data.
+        engine.AddPolicyFromFile("tests/aci/framework.rego");
+        engine.AddPolicyFromFile("tests/aci/api.rego");
+        engine.AddPolicyFromFile("tests/aci/policy.rego");
+        engine.AddDataFromJsonFile("tests/aci/data.json");
+
+        // Set input and eval rule.
+        engine.SetInputFromJsonFile("tests/aci/input.json");
+        var result = engine.EvalRule("data.framework.mount_overlay");
+
+        var expected = """
+{
+  "allowed": true,
+  "metadata": [
+    {
+      "action": "add",
+      "key": "container0",
+      "name": "matches",
+      "value": [
+        {
+          "allow_elevated": true,
+          "allow_stdio_access": false,
+          "capabilities": {
+            "ambient": [
+              "CAP_SYS_ADMIN"
+            ],
+            "bounding": [
+              "CAP_SYS_ADMIN"
+            ],
+            "effective": [
+              "CAP_SYS_ADMIN"
+            ],
+            "inheritable": [
+              "CAP_SYS_ADMIN"
+            ],
+            "permitted": [
+              "CAP_SYS_ADMIN"
+            ]
+          },
+          "command": [
+            "rustc",
+            "--help"
+          ],
+          "env_rules": [
+            {
+              "pattern": "PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+              "required": true,
+              "strategy": "string"
+            },
+            {
+              "pattern": "RUSTUP_HOME=/usr/local/rustup",
+              "required": true,
+              "strategy": "string"
+            },
+            {
+              "pattern": "CARGO_HOME=/usr/local/cargo",
+              "required": true,
+              "strategy": "string"
+            },
+            {
+              "pattern": "RUST_VERSION=1.52.1",
+              "required": true,
+              "strategy": "string"
+            },
+            {
+              "pattern": "TERM=xterm",
+              "required": false,
+              "strategy": "string"
+            },
+            {
+              "pattern": "PREFIX_.+=.+",
+              "required": false,
+              "strategy": "re2"
+            }
+          ],
+          "exec_processes": [
+            {
+              "command": [
+                "top"
+              ],
+              "signals": []
+            }
+          ],
+          "layers": [
+            "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a",
+            "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
+            "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
+            "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
+            "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
+            "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766"
+          ],
+          "mounts": [
+            {
+              "destination": "/container/path/one",
+              "options": [
+                "rbind",
+                "rshared",
+                "rw"
+              ],
+              "source": "sandbox:///host/path/one",
+              "type": "bind"
+            },
+            {
+              "destination": "/container/path/two",
+              "options": [
+                "rbind",
+                "rshared",
+                "ro"
+              ],
+              "source": "sandbox:///host/path/two",
+              "type": "bind"
+            }
+          ],
+          "no_new_privileges": true,
+          "seccomp_profile_sha256": "",
+          "signals": [],
+          "user": {
+            "group_idnames": [
+              {
+                "pattern": "",
+                "strategy": "any"
+              }
+            ],
+            "umask": "0022",
+            "user_idname": {
+              "pattern": "",
+              "strategy": "any"
+            }
+          },
+          "working_dir": "/home/user"
+        }
+      ]
+    },
+    {
+      "action": "add",
+      "key": "/run/gcs/c/container0/rootfs",
+      "name": "overlayTargets",
+      "value": true
+    }
+  ]
+}
+""";
+
+        Assert.IsTrue(JsonNode.DeepEquals(JsonNode.Parse(expected), JsonNode.Parse(result!)), $"Actual: {result}");
+    }
+
+    [TestMethod]
+    public void GetPolicyPackageNames_succeeds()
+    {
+        using var engine = new Engine();
+        engine.AddPolicy(
+            "test.rego",
+            "package test\nx = 1\nmessage = `Hello`");
+
+        engine.AddPolicy(
+            "test.rego",
+            "package test.nested.name\nx = 1\nmessage = `Hello`");
+
+        var result = engine.GetPolicyPackageNames();
+
+        var packageNames = JsonNode.Parse(result!);
+
+        Assert.AreEqual("test", packageNames![0]["package_name"].ToString());
+        Assert.AreEqual("test.nested.name", packageNames![1]["package_name"].ToString());
+    }
+
+    [TestMethod]
+    public void GetPolicyParameters_succeeds()
+    {
+        using var engine = new Engine();
+        engine.AddPolicy(
+            "test.rego",
+            "package test\n default parameters.a = 5\nparameters.b = 10\nx = 1\nmessage = `Hello`");
+
+        var result = engine.GetPolicyParameters();
+
+        var parameters = JsonNode.Parse(result!);
+
+        Assert.AreEqual(1, parameters![0]["parameters"].AsArray().Count);
+        Assert.AreEqual(1, parameters![0]["modifiers"].AsArray().Count);
+
+        Assert.AreEqual("a", parameters![0]["parameters"][0]["name"].ToString());
+        Assert.AreEqual("b", parameters![0]["modifiers"][0]["name"].ToString());
+    }
+}

bindings/csharp/Regorus.cs

@@ -1,220 +0,0 @@
-using System.Text;
-
-namespace Regorus
-{
-    public class Exception : System.Exception
-    {
-	public Exception(string? message) : base(message) {}
-    }
-
-    public class Engine : ICloneable
-    {
-	unsafe private RegorusFFI.RegorusEngine* E;
-	public Engine()
-	{
-	    unsafe
-	    {
-		E = RegorusFFI.API.regorus_engine_new();
-	    }
-	}
-
-	public object Clone()
-	{
-	    var clone = (Engine)this.MemberwiseClone();
-	    unsafe
-	    {
-		clone.E = RegorusFFI.API.regorus_engine_clone(E);
-	    }
-	    return clone;
-
-	}
-
-	public string AddPolicy(string path, string rego)
-	{
-	    var pathBytes = Encoding.UTF8.GetBytes(path);
-	    var regoBytes = Encoding.UTF8.GetBytes(rego);
-
-	    unsafe
-	    {
-		fixed (byte* pathPtr = pathBytes)
-		{
-		    fixed(byte* regoPtr = regoBytes)
-		    {
-			return CheckAndDropResult(RegorusFFI.API.regorus_engine_add_policy(E, pathPtr, regoPtr));
-		    }
-		}
-	    }
-	}
-
-	public string AddPolicyFromFile(string path)
-	{
-	    var pathBytes = Encoding.UTF8.GetBytes(path);
-
-	    unsafe
-	    {
-		fixed (byte* pathPtr = pathBytes)
-		{
-		    return CheckAndDropResult(RegorusFFI.API.regorus_engine_add_policy_from_file(E, pathPtr));
-		}
-	    }
-	}
-
-	public void AddDataJson(string data)
-	{
-	    var dataBytes = Encoding.UTF8.GetBytes(data);
-
-	    unsafe
-	    {
-		fixed (byte* dataPtr = dataBytes)
-		{
-		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_data_json(E, dataPtr));
-		}
-	    }
-	}
-
-	public void AddDataFromJsonFile(string path)
-	{
-	    var pathBytes = Encoding.UTF8.GetBytes(path);
-
-	    unsafe
-	    {
-		fixed (byte* pathPtr = pathBytes)
-		{
-		    CheckAndDropResult(RegorusFFI.API.regorus_engine_add_data_from_json_file(E, pathPtr));
-		}
-	    }
-	}
-
-	public void SetInputJson(string input)
-	{
-	    var inputBytes = Encoding.UTF8.GetBytes(input);
-
-	    unsafe
-	    {
-		fixed (byte* inputPtr = inputBytes)
-		{
-		    CheckAndDropResult(RegorusFFI.API.regorus_engine_set_input_json(E, inputPtr));
-		}
-	    }
-	}
-
-	public void SetInputFromJsonFile(string path)
-	{
-	    var pathBytes = Encoding.UTF8.GetBytes(path);
-
-	    unsafe
-	    {
-		fixed (byte* pathPtr = pathBytes)
-		{
-		    CheckAndDropResult(RegorusFFI.API.regorus_engine_set_input_from_json_file(E, pathPtr));
-		}
-	    }
-	}
-
-	public string EvalQuery(string query)
-	{
-	    var queryBytes = Encoding.UTF8.GetBytes(query);
-
-	    unsafe
-	    {
-		fixed (byte* queryPtr = queryBytes)
-		{
-		    return CheckAndDropResult(RegorusFFI.API.regorus_engine_eval_query(E, queryPtr));
-		}
-	    }
-	}
-
-	public string EvalRule(string rule)
-	{
-	    var ruleBytes = Encoding.UTF8.GetBytes(rule);
-
-	    unsafe
-	    {
-		fixed (byte* rulePtr = ruleBytes)
-		{
-		    return CheckAndDropResult(RegorusFFI.API.regorus_engine_eval_query(E, rulePtr));
-		}
-	    }
-	}
-	
-	public void SetEnableCoverage(bool enable)
-	{
-	    unsafe
-	    {
-		CheckAndDropResult(RegorusFFI.API.regorus_engine_set_enable_coverage(E, enable));
-	    }
-	}
-	
-	public void ClearCoverageData()
-	{
-	    unsafe
-	    {
-		CheckAndDropResult(RegorusFFI.API.regorus_engine_clear_coverage_data(E));
-	    }
-	}
-	
-	public string GetCoverageReport()
-	{
-	    unsafe
-	    {
-		return CheckAndDropResult(RegorusFFI.API.regorus_engine_get_coverage_report(E));
-	    }
-	}
-	
-	public string GetCoverageReportPretty()
-	{
-	    unsafe
-	    {
-		return CheckAndDropResult(RegorusFFI.API.regorus_engine_get_coverage_report_pretty(E));
-	    }
-	}
-	
-	public void SetGatherPrints(bool enable)
-	{
-	    unsafe
-	    {
-		CheckAndDropResult(RegorusFFI.API.regorus_engine_set_gather_prints(E, enable));
-	    }
-	}
-	
-	public string TakePrints()
-	{
-	    unsafe
-	    {
-		return CheckAndDropResult(RegorusFFI.API.regorus_engine_take_prints(E));
-	    }
-	}
-	
-	~Engine()
-	{
-	    unsafe
-	    {
-		RegorusFFI.API.regorus_engine_drop(E);
-	    }
-	}
-
-
-	string CheckAndDropResult(RegorusFFI.RegorusResult result)
-	{
-	    if (result.status != RegorusFFI.RegorusStatus.RegorusStatusOk) {
-		unsafe {
-		    var message = System.Runtime.InteropServices.Marshal.PtrToStringUTF8((IntPtr)result.error_message);
-		    var ex = new Exception(message);
-		    RegorusFFI.API.regorus_result_drop(result);
-		    throw ex;
-		}
-	    }
-
-	    var resultString = "";
-	    unsafe
-	    {
-		if (result.output is not null) {
-		    resultString = System.Runtime.InteropServices.Marshal.PtrToStringUTF8((IntPtr)result.output);
-		}
-		RegorusFFI.API.regorus_result_drop(result);
-	    }
-	    return resultString;
-	}
-
-    }
-}

bindings/csharp/Regorus/CompiledPolicy.cs

@@ -0,0 +1,168 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Text;
+using System.Text.Json;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Represents a compiled Regorus policy that can be evaluated efficiently.
+    /// This class wraps a pre-compiled policy that can be evaluated multiple times
+    /// with different inputs without recompilation overhead.
+    /// 
+    /// This class manages unmanaged resources and should not be copied or cloned.
+    /// Each instance represents a unique native policy object.
+    /// 
+    /// Thread Safety: This class is thread-safe for all operations. Multiple threads
+    /// can safely call EvalWithInput() concurrently, and Dispose() will safely wait
+    /// for all active evaluations to complete before freeing resources. No external
+    /// synchronization is required.
+    /// </summary>
+    public unsafe sealed class CompiledPolicy : IDisposable
+    {
+        private Internal.RegorusCompiledPolicy* _policy;
+        private int _isDisposed;
+        private int _activeEvaluations;
+
+        internal CompiledPolicy(Internal.RegorusCompiledPolicy* policy)
+        {
+            _policy = policy;
+        }
+
+        /// <summary>
+        /// Evaluates the compiled policy with the given input.
+        /// For target policies, evaluates the target's effect rule.
+        /// For regular policies, evaluates the originally compiled rule.
+        /// </summary>
+        /// <param name="inputJson">JSON encoded input data (resource) to validate against the policy</param>
+        /// <returns>The evaluation result as JSON string</returns>
+        /// <exception cref="Exception">Thrown when policy evaluation fails</exception>
+        /// <exception cref="ObjectDisposedException">Thrown when the policy has been disposed</exception>
+        public string? EvalWithInput(string inputJson)
+        {
+            // Increment active evaluations count
+            System.Threading.Interlocked.Increment(ref _activeEvaluations);
+            try
+            {
+                ThrowIfDisposed();
+                
+                var inputBytes = Encoding.UTF8.GetBytes(inputJson + char.MinValue);
+                fixed (byte* inputPtr = inputBytes)
+                {
+                    return CheckAndDropResult(Internal.API.regorus_compiled_policy_eval_with_input(_policy, inputPtr));
+                }
+            }
+            finally
+            {
+                // Decrement active evaluations count
+                System.Threading.Interlocked.Decrement(ref _activeEvaluations);
+            }
+        }
+
+        /// <summary>
+        /// Gets information about the compiled policy including metadata about modules,
+        /// target configuration, and resource types.
+        /// </summary>
+        /// <returns>Policy information containing module IDs, target name, applicable resource types, entry point rule, and parameters</returns>
+        /// <exception cref="Exception">Thrown when getting policy info fails</exception>
+        /// <exception cref="ObjectDisposedException">Thrown when the policy has been disposed</exception>
+        public PolicyInfo GetPolicyInfo()
+        {
+            ThrowIfDisposed();
+            var jsonResult = CheckAndDropResult(Internal.API.regorus_compiled_policy_get_policy_info(_policy));
+            
+            if (string.IsNullOrEmpty(jsonResult))
+            {
+                throw new Exception("Failed to get policy info: empty response");
+            }
+
+            try
+            {
+                var options = new JsonSerializerOptions
+                {
+                    PropertyNameCaseInsensitive = true
+                };
+                
+                return JsonSerializer.Deserialize<PolicyInfo>(jsonResult!, options) 
+                    ?? throw new Exception("Failed to deserialize policy info");
+            }
+            catch (JsonException ex)
+            {
+                throw new Exception($"Failed to parse policy info JSON: {ex.Message}", ex);
+            }
+        }
+
+        public void Dispose()
+        {
+            Dispose(disposing: true);
+            GC.SuppressFinalize(this);
+        }
+
+        private void Dispose(bool disposing)
+        {
+            if (System.Threading.Interlocked.CompareExchange(ref _isDisposed, 1, 0) == 0)
+            {
+                if (_policy != null)
+                {
+                    // Wait for all active evaluations to complete
+                    while (System.Threading.Volatile.Read(ref _activeEvaluations) > 0)
+                    {
+                        System.Threading.Thread.Yield();
+                    }
+                    
+                    Internal.API.regorus_compiled_policy_drop(_policy);
+                    _policy = null;
+                }
+            }
+        }
+
+        ~CompiledPolicy() => Dispose(disposing: false);
+
+        private void ThrowIfDisposed()
+        {
+            if (_isDisposed != 0)
+                throw new ObjectDisposedException(nameof(CompiledPolicy));
+        }
+
+        private string? StringFromUTF8(IntPtr ptr)
+        {
+#if NETSTANDARD2_1
+            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
+#else
+            int len = 0;
+            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
+            byte[] buffer = new byte[len];
+            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
+            return Encoding.UTF8.GetString(buffer);
+#endif
+        }
+
+        private string? CheckAndDropResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type switch
+                {
+                    Internal.RegorusDataType.String => StringFromUTF8((IntPtr)result.output),
+                    Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
+                    Internal.RegorusDataType.Integer => result.int_value.ToString(),
+                    Internal.RegorusDataType.None => null,
+                    _ => StringFromUTF8((IntPtr)result.output)
+                };
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+    }
+}

bindings/csharp/Regorus/Compiler.cs

@@ -0,0 +1,196 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Runtime.InteropServices;
+using System.Text;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Represents a policy module with an ID and content.
+    /// </summary>
+    public struct PolicyModule
+    {
+        /// <summary>
+        /// Gets or sets the unique identifier for this policy module.
+        /// </summary>
+        public string Id { get; set; }
+
+        /// <summary>
+        /// Gets or sets the Rego policy content.
+        /// </summary>
+        public string Content { get; set; }
+
+        /// <summary>
+        /// Initializes a new instance of the PolicyModule struct.
+        /// </summary>
+        /// <param name="id">The unique identifier for this policy module</param>
+        /// <param name="content">The Rego policy content</param>
+        public PolicyModule(string id, string content)
+        {
+            Id = id;
+            Content = content;
+        }
+    }
+
+    /// <summary>
+    /// Provides static methods for compiling policies into efficient compiled representations.
+    /// These are convenience methods that create an engine internally and perform compilation.
+    /// </summary>
+    public static unsafe class Compiler
+    {
+        /// <summary>
+        /// Compiles a policy from data and modules with a specific entry point rule.
+        /// This is a convenience function that sets up an Engine internally and calls the appropriate compilation method.
+        /// </summary>
+        /// <param name="dataJson">JSON string containing static data for policy evaluation</param>
+        /// <param name="modules">List of policy modules to compile</param>
+        /// <param name="entryPointRule">The specific rule path to evaluate (e.g., "data.policy.allow")</param>
+        /// <returns>A compiled policy that can be evaluated efficiently</returns>
+        /// <exception cref="Exception">Thrown when compilation fails</exception>
+        public static CompiledPolicy CompilePolicyWithEntrypoint(string dataJson, IEnumerable<PolicyModule> modules, string entryPointRule)
+        {
+            var dataBytes = Encoding.UTF8.GetBytes(dataJson + char.MinValue);
+            var entryPointBytes = Encoding.UTF8.GetBytes(entryPointRule + char.MinValue);
+            var modulesArray = modules.ToArray();
+
+            // Convert C# modules to native structs
+            var nativeModules = new Internal.RegorusPolicyModule[modulesArray.Length];
+            var pinnedHandles = new List<GCHandle>();
+
+            try
+            {
+                for (int i = 0; i < modulesArray.Length; i++)
+                {
+                    var idBytes = Encoding.UTF8.GetBytes(modulesArray[i].Id + char.MinValue);
+                    var contentBytes = Encoding.UTF8.GetBytes(modulesArray[i].Content + char.MinValue);
+
+                    var idHandle = GCHandle.Alloc(idBytes, GCHandleType.Pinned);
+                    var contentHandle = GCHandle.Alloc(contentBytes, GCHandleType.Pinned);
+                    pinnedHandles.Add(idHandle);
+                    pinnedHandles.Add(contentHandle);
+
+                    nativeModules[i] = new Internal.RegorusPolicyModule
+                    {
+                        id = (byte*)idHandle.AddrOfPinnedObject(),
+                        content = (byte*)contentHandle.AddrOfPinnedObject()
+                    };
+                }
+
+                fixed (byte* dataPtr = dataBytes)
+                fixed (byte* entryPointPtr = entryPointBytes)
+                fixed (Internal.RegorusPolicyModule* modulesPtr = nativeModules)
+                {
+                    var result = Internal.API.regorus_compile_policy_with_entrypoint(
+                        dataPtr, modulesPtr, (UIntPtr)modulesArray.Length, entryPointPtr);
+
+                    var policy = GetCompiledPolicyResult(result);
+                    return policy;
+                }
+            }
+            finally
+            {
+                foreach (var handle in pinnedHandles)
+                {
+                    handle.Free();
+                }
+            }
+        }
+
+        /// <summary>
+        /// Compiles a target-aware policy from data and modules.
+        /// This is a convenience function that sets up an Engine internally and calls target-aware compilation.
+        /// At least one module must contain a `__target__` declaration.
+        /// </summary>
+        /// <param name="dataJson">JSON string containing static data for policy evaluation</param>
+        /// <param name="modules">List of policy modules to compile</param>
+        /// <returns>A compiled policy that can be evaluated efficiently</returns>
+        /// <exception cref="Exception">Thrown when compilation fails</exception>
+        public static CompiledPolicy CompilePolicyForTarget(string dataJson, IEnumerable<PolicyModule> modules)
+        {
+            var dataBytes = Encoding.UTF8.GetBytes(dataJson + char.MinValue);
+            var modulesArray = modules.ToArray();
+
+            // Convert C# modules to native structs
+            var nativeModules = new Internal.RegorusPolicyModule[modulesArray.Length];
+            var pinnedHandles = new List<GCHandle>();
+
+            try
+            {
+                for (int i = 0; i < modulesArray.Length; i++)
+                {
+                    var idBytes = Encoding.UTF8.GetBytes(modulesArray[i].Id + char.MinValue);
+                    var contentBytes = Encoding.UTF8.GetBytes(modulesArray[i].Content + char.MinValue);
+
+                    var idHandle = GCHandle.Alloc(idBytes, GCHandleType.Pinned);
+                    var contentHandle = GCHandle.Alloc(contentBytes, GCHandleType.Pinned);
+                    pinnedHandles.Add(idHandle);
+                    pinnedHandles.Add(contentHandle);
+
+                    nativeModules[i] = new Internal.RegorusPolicyModule
+                    {
+                        id = (byte*)idHandle.AddrOfPinnedObject(),
+                        content = (byte*)contentHandle.AddrOfPinnedObject()
+                    };
+                }
+
+                fixed (byte* dataPtr = dataBytes)
+                fixed (Internal.RegorusPolicyModule* modulesPtr = nativeModules)
+                {
+                    var result = Internal.API.regorus_compile_policy_for_target(
+                        dataPtr, modulesPtr, (UIntPtr)modulesArray.Length);
+
+                    var policy = GetCompiledPolicyResult(result);
+                    return policy;
+                }
+            }
+            finally
+            {
+                foreach (var handle in pinnedHandles)
+                {
+                    handle.Free();
+                }
+            }
+        }
+
+        private static string? StringFromUTF8(IntPtr ptr)
+        {
+#if NETSTANDARD2_1
+            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
+#else
+            int len = 0;
+            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
+            byte[] buffer = new byte[len];
+            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
+            return Encoding.UTF8.GetString(buffer);
+#endif
+        }
+
+        private static CompiledPolicy GetCompiledPolicyResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown compilation error occurred");
+                }
+
+                if (result.data_type != Internal.RegorusDataType.Pointer || result.pointer_value == null)
+                {
+                    throw new Exception("Expected compiled policy pointer but got different data type");
+                }
+
+                return new CompiledPolicy((Internal.RegorusCompiledPolicy*)result.pointer_value);
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+    }
+}

bindings/csharp/Regorus/Engine.cs

@@ -0,0 +1,264 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// C# Wrapper for the Regorus engine.
+    /// This class is not thread-safe. For multithreaded use, prefer cloning after adding policies and data to an instance.
+    /// Cloning is cheap and involves only incrementing reference counts for shared immutable objects like parsed policies,
+    /// data etc. Mutable state is deep copied as needed.
+    /// </summary>
+    public unsafe sealed class Engine : System.IDisposable
+    {
+        private Regorus.Internal.RegorusEngine* E;
+        // Detect redundant Dispose() calls in a thread-safe manner.
+        // _isDisposed == 0 means Dispose(bool) has not been called yet.
+        // _isDisposed == 1 means Dispose(bool) has been already called.
+        private int isDisposed;
+
+        public Engine()
+        {
+            E = Regorus.Internal.API.regorus_engine_new();
+        }
+
+        public void Dispose()
+        {
+            Dispose(disposing: true);
+
+            // This object will be cleaned up by the Dispose method.
+            // Therefore, call GC.SuppressFinalize to
+            // take this object off the finalization queue
+            // and prevent finalization code for this object
+            // from executing a second time.
+            GC.SuppressFinalize(this);
+        }
+
+        // Dispose(bool disposing) executes in two distinct scenarios.
+        // If disposing equals true, the method has been called directly
+        // or indirectly by a user's code. Managed and unmanaged resources
+        // can be disposed.
+        // If disposing equals false, the method has been called by the
+        // runtime from inside the finalizer and you should not reference
+        // other objects. Only unmanaged resources can be disposed.
+        void Dispose(bool disposing)
+        {
+            // In case _isDisposed is 0, atomically set it to 1.
+            // Enter the branch only if the original value is 0.
+            if (System.Threading.Interlocked.CompareExchange(ref isDisposed, 1, 0) == 0)
+            {
+                // If disposing equals true, dispose all managed
+                // and unmanaged resources.
+                if (disposing)
+                {
+                    // No managed resource to dispose.
+                }
+
+                // Call the appropriate methods to clean up
+                // unmanaged resources here.
+                // If disposing is false,
+                // only the following code is executed.
+                if (E != null)
+                {
+                    Regorus.Internal.API.regorus_engine_drop(E);
+                    E = null;
+                }
+
+            }
+        }
+
+        // Use C# finalizer syntax for finalization code.
+        // This finalizer will run only if the Dispose method
+        // does not get called.
+        ~Engine() => Dispose(disposing: false);
+
+        // Helper for implementing Clone
+        private Engine(Internal.RegorusEngine* engine)
+        {
+            this.E = engine;
+        }
+
+        public Engine Clone() => new(Internal.API.regorus_engine_clone(E));
+
+        public void SetStrictBuiltinErrors(bool strict)
+        {
+            CheckAndDropResult(Regorus.Internal.API.regorus_engine_set_strict_builtin_errors(E, strict));
+        }
+        byte[] NullTerminatedUTF8Bytes(string s)
+        {
+            return Encoding.UTF8.GetBytes(s + char.MinValue);
+        }
+
+        public string? AddPolicy(string path, string rego)
+        {
+            var pathBytes = NullTerminatedUTF8Bytes(path);
+            var regoBytes = NullTerminatedUTF8Bytes(rego);
+
+
+            fixed (byte* pathPtr = pathBytes)
+            {
+                fixed (byte* regoPtr = regoBytes)
+                {
+                    return CheckAndDropResult(Regorus.Internal.API.regorus_engine_add_policy(E, pathPtr, regoPtr));
+                }
+            }
+
+        }
+
+        public void SetRegoV0(bool enable)
+        {
+            CheckAndDropResult(Regorus.Internal.API.regorus_engine_set_rego_v0(E, enable));
+        }
+
+        public string? AddPolicyFromFile(string path)
+        {
+            var pathBytes = NullTerminatedUTF8Bytes(path);
+            fixed (byte* pathPtr = pathBytes)
+            {
+                return CheckAndDropResult(Regorus.Internal.API.regorus_engine_add_policy_from_file(E, pathPtr));
+            }
+
+        }
+
+        public void AddDataJson(string data)
+        {
+            var dataBytes = NullTerminatedUTF8Bytes(data);
+            fixed (byte* dataPtr = dataBytes)
+            {
+                CheckAndDropResult(Regorus.Internal.API.regorus_engine_add_data_json(E, dataPtr));
+            }
+
+        }
+
+        public void AddDataFromJsonFile(string path)
+        {
+            var pathBytes = NullTerminatedUTF8Bytes(path);
+            fixed (byte* pathPtr = pathBytes)
+            {
+                CheckAndDropResult(Regorus.Internal.API.regorus_engine_add_data_from_json_file(E, pathPtr));
+            }
+
+        }
+
+        public void SetInputJson(string input)
+        {
+            var inputBytes = NullTerminatedUTF8Bytes(input);
+            fixed (byte* inputPtr = inputBytes)
+            {
+                CheckAndDropResult(Regorus.Internal.API.regorus_engine_set_input_json(E, inputPtr));
+            }
+        }
+
+        public void SetInputFromJsonFile(string path)
+        {
+            var pathBytes = NullTerminatedUTF8Bytes(path);
+            fixed (byte* pathPtr = pathBytes)
+            {
+                CheckAndDropResult(Regorus.Internal.API.regorus_engine_set_input_from_json_file(E, pathPtr));
+            }
+        }
+
+        public string? EvalQuery(string query)
+        {
+            var queryBytes = NullTerminatedUTF8Bytes(query);
+            fixed (byte* queryPtr = queryBytes)
+            {
+                return CheckAndDropResult(Regorus.Internal.API.regorus_engine_eval_query(E, queryPtr));
+            }
+        }
+
+        public string? EvalRule(string rule)
+        {
+            var ruleBytes = NullTerminatedUTF8Bytes(rule);
+            fixed (byte* rulePtr = ruleBytes)
+            {
+                return CheckAndDropResult(Regorus.Internal.API.regorus_engine_eval_rule(E, rulePtr));
+            }
+        }
+
+        public void SetEnableCoverage(bool enable)
+        {
+            CheckAndDropResult(Regorus.Internal.API.regorus_engine_set_enable_coverage(E, enable));
+        }
+
+        public void ClearCoverageData()
+        {
+            CheckAndDropResult(Regorus.Internal.API.regorus_engine_clear_coverage_data(E));
+        }
+
+        public string? GetCoverageReport()
+        {
+            return CheckAndDropResult(Regorus.Internal.API.regorus_engine_get_coverage_report(E));
+        }
+
+        public string? GetCoverageReportPretty()
+        {
+            return CheckAndDropResult(Regorus.Internal.API.regorus_engine_get_coverage_report_pretty(E));
+        }
+
+        public void SetGatherPrints(bool enable)
+        {
+            CheckAndDropResult(Regorus.Internal.API.regorus_engine_set_gather_prints(E, enable));
+        }
+
+        public string? TakePrints()
+        {
+            return CheckAndDropResult(Regorus.Internal.API.regorus_engine_take_prints(E));
+        }
+
+        public string? GetAstAsJson()
+        {
+            return CheckAndDropResult(Regorus.Internal.API.regorus_engine_get_ast_as_json(E));
+        }
+
+        public string? GetPolicyPackageNames()
+        {
+            return CheckAndDropResult(Regorus.Internal.API.regorus_engine_get_policy_package_names(E));
+        }
+
+        public string? GetPolicyParameters()
+        {
+            return CheckAndDropResult(Regorus.Internal.API.regorus_engine_get_policy_parameters(E));
+        }
+
+        string? StringFromUTF8(IntPtr ptr)
+        {
+
+#if NETSTANDARD2_1
+				return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
+#else
+            int len = 0;
+            while (Marshal.ReadByte(ptr, len) != 0) { ++len; }
+            byte[] buffer = new byte[len];
+            Marshal.Copy(ptr, buffer, 0, buffer.Length);
+            return Encoding.UTF8.GetString(buffer);
+#endif
+        }
+
+        string? CheckAndDropResult(Regorus.Internal.RegorusResult result)
+        {
+            if (result.status != Regorus.Internal.RegorusStatus.Ok)
+            {
+                var message = StringFromUTF8((IntPtr)result.error_message);
+                var ex = new Exception(message);
+                Regorus.Internal.API.regorus_result_drop(result);
+                throw ex;
+            }
+
+            var resultString = "";
+            if (result.output is not null)
+            {
+                resultString = StringFromUTF8((IntPtr)result.output);
+            }
+            Regorus.Internal.API.regorus_result_drop(result);
+            return resultString;
+        }
+
+    }
+}

bindings/csharp/Regorus/NativeMethods.cs

@@ -0,0 +1,546 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Runtime.InteropServices;
+
+#pragma warning disable CS8500
+#pragma warning disable CS8981
+
+namespace Regorus.Internal
+{
+    /// <summary>
+    /// Native FFI method declarations for Regorus.
+    /// This file contains all P/Invoke declarations for the Regorus native library.
+    /// </summary>
+    internal static unsafe partial class API
+    {
+        private const string LibraryName = "regorus_ffi";
+
+        #region Common Methods
+
+        /// <summary>
+        /// Drop a RegorusResult.
+        /// output and error_message strings are not valid after drop.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_result_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern void regorus_result_drop(RegorusResult result);
+
+        #endregion
+
+        #region Engine Methods
+
+        /// <summary>
+        /// Construct a new Engine.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_new", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusEngine* regorus_engine_new();
+
+        /// <summary>
+        /// Clone a RegorusEngine.
+        /// To avoid having to parse same policy again, the engine can be cloned
+        /// after policies and data have been added.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_clone", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusEngine* regorus_engine_clone(RegorusEngine* engine);
+
+        /// <summary>
+        /// Drop a RegorusEngine.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern void regorus_engine_drop(RegorusEngine* engine);
+
+        /// <summary>
+        /// Add a policy.
+        /// The policy is parsed into AST.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_policy
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_add_policy", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_add_policy(RegorusEngine* engine, byte* path, byte* rego);
+
+        /// <summary>
+        /// Add a policy from file.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_add_policy_from_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_add_policy_from_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>
+        /// Add policy data.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.add_data
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_add_data_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_add_data_json(RegorusEngine* engine, byte* data);
+
+        /// <summary>
+        /// Get list of loaded Rego packages as JSON.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.get_packages
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_get_packages", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_get_packages(RegorusEngine* engine);
+
+        /// <summary>
+        /// Get list of policies as JSON.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.get_policies
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_get_policies", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_get_policies(RegorusEngine* engine);
+
+        /// <summary>
+        /// Add data from JSON file.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_add_data_from_json_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_add_data_from_json_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>
+        /// Clear policy data.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.clear_data
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_clear_data", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_clear_data(RegorusEngine* engine);
+
+        /// <summary>
+        /// Set input.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.set_input
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_set_input_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_set_input_json(RegorusEngine* engine, byte* input);
+
+        /// <summary>
+        /// Set input from JSON file.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_set_input_from_json_file", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_set_input_from_json_file(RegorusEngine* engine, byte* path);
+
+        /// <summary>
+        /// Evaluate query.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.eval_query
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_eval_query", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_eval_query(RegorusEngine* engine, byte* query);
+
+        /// <summary>
+        /// Evaluate specified rule.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.eval_rule
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_eval_rule", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_eval_rule(RegorusEngine* engine, byte* rule);
+
+        /// <summary>
+        /// Enable/disable coverage.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.set_enable_coverage
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_set_enable_coverage", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_set_enable_coverage(RegorusEngine* engine, [MarshalAs(UnmanagedType.U1)] bool enable);
+
+        /// <summary>
+        /// Get coverage report.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.get_coverage_report
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_get_coverage_report", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_get_coverage_report(RegorusEngine* engine);
+
+        /// <summary>
+        /// Enable/disable strict builtin errors.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.set_strict_builtin_errors
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_set_strict_builtin_errors", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_set_strict_builtin_errors(RegorusEngine* engine, [MarshalAs(UnmanagedType.U1)] bool strict);
+
+        /// <summary>
+        /// Get pretty printed coverage report.
+        /// See https://docs.rs/regorus/latest/regorus/coverage/struct.Report.html#method.to_string_pretty
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_get_coverage_report_pretty", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_get_coverage_report_pretty(RegorusEngine* engine);
+
+        /// <summary>
+        /// Clear coverage data.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.clear_coverage_data
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_clear_coverage_data", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_clear_coverage_data(RegorusEngine* engine);
+
+        /// <summary>
+        /// Whether to gather output of print statements.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.set_gather_prints
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_set_gather_prints", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_set_gather_prints(RegorusEngine* engine, [MarshalAs(UnmanagedType.U1)] bool enable);
+
+        /// <summary>
+        /// Take all the gathered print statements.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.take_prints
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_take_prints", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_take_prints(RegorusEngine* engine);
+
+        /// <summary>
+        /// Get AST of policies.
+        /// See https://docs.rs/regorus/latest/regorus/coverage/struct.Engine.html#method.get_ast_as_json
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_get_ast_as_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_get_ast_as_json(RegorusEngine* engine);
+
+        /// <summary>
+        /// Gets the package names defined in each policy added to the engine.
+        /// See https://docs.rs/regorus/latest/regorus/coverage/struct.Engine.html#method.get_policy_package_names
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_get_policy_package_names", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_get_policy_package_names(RegorusEngine* engine);
+
+        /// <summary>
+        /// Gets the parameters defined in each policy added to the engine.
+        /// See https://docs.rs/regorus/latest/regorus/coverage/struct.Engine.html#method.get_policy_parameters
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_get_policy_parameters", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_get_policy_parameters(RegorusEngine* engine);
+
+        /// <summary>
+        /// Enable/disable rego v1.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.set_rego_v0
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_set_rego_v0", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_set_rego_v0(RegorusEngine* engine, [MarshalAs(UnmanagedType.U1)] bool enable);
+
+        /// <summary>
+        /// Compile a target-aware policy from the current engine state.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.compile_for_target
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_compile_for_target", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_compile_for_target(RegorusEngine* engine);
+
+        /// <summary>
+        /// Compile a policy with a specific entry point rule.
+        /// See https://docs.rs/regorus/latest/regorus/struct.Engine.html#method.compile_with_entrypoint
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_engine_compile_with_entrypoint", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_engine_compile_with_entrypoint(RegorusEngine* engine, byte* rule);
+
+        #endregion
+
+        #region Compilation Methods
+
+        /// <summary>
+        /// Compiles a policy from data and modules with a specific entry point rule.
+        /// This is a convenience function that wraps regorus::compile_policy_with_entrypoint.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_compile_policy_with_entrypoint", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_compile_policy_with_entrypoint(byte* data_json, RegorusPolicyModule* modules, UIntPtr modules_len, byte* entry_point_rule);
+
+        /// <summary>
+        /// Compiles a target-aware policy from data and modules.
+        /// This is a convenience function that wraps regorus::compile_policy_for_target.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_compile_policy_for_target", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_compile_policy_for_target(byte* data_json, RegorusPolicyModule* modules, UIntPtr modules_len);
+
+        #endregion
+
+        #region Compiled Policy Methods
+
+        /// <summary>
+        /// Drop a RegorusCompiledPolicy.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_compiled_policy_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern void regorus_compiled_policy_drop(RegorusCompiledPolicy* compiled_policy);
+
+        /// <summary>
+        /// Evaluate the compiled policy with the given input.
+        /// For target policies, evaluates the target's effect rule.
+        /// For regular policies, evaluates the originally compiled rule.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_compiled_policy_eval_with_input", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_compiled_policy_eval_with_input(RegorusCompiledPolicy* compiled_policy, byte* input);
+
+        /// <summary>
+        /// Get information about the compiled policy including metadata about modules,
+        /// target configuration, and resource types.
+        /// Returns a JSON-encoded PolicyInfo struct containing comprehensive
+        /// information about the compiled policy such as module IDs, target name,
+        /// applicable resource types, entry point rule, and parameters.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_compiled_policy_get_policy_info", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_compiled_policy_get_policy_info(RegorusCompiledPolicy* compiled_policy);
+
+        #endregion
+
+        #region Target Registry Methods
+
+        /// <summary>
+        /// Register a target from JSON definition.
+        /// The target JSON should follow the target schema format.
+        /// Once registered, the target can be referenced in Rego policies using __target__ rules.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_register_target_from_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_register_target_from_json(byte* target_json);
+
+        /// <summary>
+        /// Check if a target is registered.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_target_registry_contains", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_target_registry_contains(byte* name);
+
+        /// <summary>
+        /// Get a list of all registered target names as JSON array.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_target_registry_list_names", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_target_registry_list_names();
+
+        /// <summary>
+        /// Remove a target from the registry by name.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_target_registry_remove", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_target_registry_remove(byte* name);
+
+        /// <summary>
+        /// Clear all targets from the registry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_target_registry_clear", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_target_registry_clear();
+
+        /// <summary>
+        /// Get the number of registered targets.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_target_registry_len", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_target_registry_len();
+
+        /// <summary>
+        /// Check if the target registry is empty.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_target_registry_is_empty", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_target_registry_is_empty();
+
+        #endregion
+
+        #region Resource Schema Registry Methods
+
+        /// <summary>
+        /// Register a resource schema from JSON with a given name.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_resource_schema_register", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_resource_schema_register(byte* name, byte* schema_json);
+
+        /// <summary>
+        /// Check if a resource schema with the given name exists.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_resource_schema_contains", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_resource_schema_contains(byte* name);
+
+        /// <summary>
+        /// Get the number of registered resource schemas.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_resource_schema_len", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_resource_schema_len();
+
+        /// <summary>
+        /// Check if the resource schema registry is empty.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_resource_schema_is_empty", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_resource_schema_is_empty();
+
+        /// <summary>
+        /// List all registered resource schema names as a JSON array.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_resource_schema_list_names", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_resource_schema_list_names();
+
+        /// <summary>
+        /// Remove a resource schema by name.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_resource_schema_remove", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_resource_schema_remove(byte* name);
+
+        /// <summary>
+        /// Clear all resource schemas from the registry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_resource_schema_clear", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_resource_schema_clear();
+
+        #endregion
+
+        #region Effect Schema Registry Methods
+
+        /// <summary>
+        /// Register an effect schema from JSON with a given name.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_effect_schema_register", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_effect_schema_register(byte* name, byte* schema_json);
+
+        /// <summary>
+        /// Check if an effect schema with the given name exists.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_effect_schema_contains", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_effect_schema_contains(byte* name);
+
+        /// <summary>
+        /// Get the number of registered effect schemas.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_effect_schema_len", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_effect_schema_len();
+
+        /// <summary>
+        /// Check if the effect schema registry is empty.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_effect_schema_is_empty", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_effect_schema_is_empty();
+
+        /// <summary>
+        /// List all registered effect schema names as a JSON array.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_effect_schema_list_names", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_effect_schema_list_names();
+
+        /// <summary>
+        /// Remove an effect schema by name.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_effect_schema_remove", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_effect_schema_remove(byte* name);
+
+        /// <summary>
+        /// Clear all effect schemas from the registry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_effect_schema_clear", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_effect_schema_clear();
+
+        #endregion
+    }
+
+    #region Native Structures
+
+    /// <summary>
+    /// Type of data contained in RegorusResult.
+    /// </summary>
+    internal enum RegorusDataType : uint
+    {
+        /// <summary>
+        /// No data / void.
+        /// </summary>
+        None,
+        /// <summary>
+        /// String data (output field is valid).
+        /// </summary>
+        String,
+        /// <summary>
+        /// Boolean data (bool_value field is valid).
+        /// </summary>
+        Boolean,
+        /// <summary>
+        /// Integer data (int_value field is valid).
+        /// </summary>
+        Integer,
+        /// <summary>
+        /// Pointer data (pointer_value field is valid).
+        /// </summary>
+        Pointer,
+    }
+
+    /// <summary>
+    /// Status of a call on RegorusEngine.
+    /// </summary>
+    internal enum RegorusStatus : uint
+    {
+        /// <summary>
+        /// The operation was successful.
+        /// </summary>
+        Ok,
+        /// <summary>
+        /// The operation was unsuccessful.
+        /// </summary>
+        Error,
+        /// <summary>
+        /// Invalid data format provided.
+        /// </summary>
+        InvalidDataFormat,
+        /// <summary>
+        /// Invalid entrypoint rule specified.
+        /// </summary>
+        InvalidEntrypoint,
+        /// <summary>
+        /// Compilation failed.
+        /// </summary>
+        CompilationFailed,
+        /// <summary>
+        /// Invalid argument provided.
+        /// </summary>
+        InvalidArgument,
+        /// <summary>
+        /// Invalid module ID.
+        /// </summary>
+        InvalidModuleId,
+        /// <summary>
+        /// Invalid policy content.
+        /// </summary>
+        InvalidPolicy,
+    }
+
+    /// <summary>
+    /// Result of a call on RegorusEngine.
+    /// Must be freed using regorus_result_drop.
+    /// </summary>
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusResult
+    {
+        /// <summary>
+        /// Status.
+        /// </summary>
+        public RegorusStatus status;
+        /// <summary>
+        /// Type of data contained in this result.
+        /// </summary>
+        public RegorusDataType data_type;
+        /// <summary>
+        /// String output produced by the call.
+        /// Valid when data_type is String. Owned by Rust.
+        /// </summary>
+        public byte* output;
+        /// <summary>
+        /// Boolean value.
+        /// Valid when data_type is Boolean.
+        /// </summary>
+        public bool bool_value;
+        /// <summary>
+        /// Integer value.
+        /// Valid when data_type is Integer.
+        /// </summary>
+        public long int_value;
+        /// <summary>
+        /// Pointer value.
+        /// Valid when data_type is Pointer.
+        /// </summary>
+        public void* pointer_value;
+        /// <summary>
+        /// Errors produced by the call.
+        /// Owned by Rust.
+        /// </summary>
+        public byte* error_message;
+    }
+
+    /// <summary>
+    /// Wrapper for regorus::Engine.
+    /// </summary>
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusEngine
+    {
+    }
+
+    /// <summary>
+    /// Wrapper for regorus::CompiledPolicy.
+    /// </summary>
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusCompiledPolicy
+    {
+    }
+
+    /// <summary>
+    /// FFI wrapper for PolicyModule struct.
+    /// </summary>
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusPolicyModule
+    {
+        public byte* id;
+        public byte* content;
+    }
+
+    #endregion
+}

bindings/csharp/Regorus/PolicyInfo.cs

@@ -0,0 +1,141 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System.Collections.Generic;
+using System.Text.Json.Serialization;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Information about a compiled policy, including metadata about modules,
+    /// target configuration, and resource types that the policy can evaluate.
+    /// </summary>
+    public class PolicyInfo
+    {
+        /// <summary>
+        /// List of module identifiers that were compiled into this policy.
+        /// Each module ID represents a unique policy module that contributes
+        /// rules, functions, or data to the compiled policy.
+        /// </summary>
+        [JsonPropertyName("module_ids")]
+        public List<string> ModuleIds { get; set; } = new List<string>();
+
+        /// <summary>
+        /// Name of the target configuration used during compilation, if any.
+        /// This indicates which target schema and validation rules were applied.
+        /// </summary>
+        [JsonPropertyName("target_name")]
+        public string? TargetName { get; set; }
+
+        /// <summary>
+        /// List of resource types that this policy can evaluate.
+        /// For target-aware policies, this contains the inferred or configured
+        /// resource types. For general policies, this may be empty.
+        /// </summary>
+        [JsonPropertyName("applicable_resource_types")]
+        public List<string> ApplicableResourceTypes { get; set; } = new List<string>();
+
+        /// <summary>
+        /// The primary rule or entrypoint that this policy evaluates.
+        /// This is the rule path that will be executed when the policy runs.
+        /// </summary>
+        [JsonPropertyName("entrypoint_rule")]
+        public string EntrypointRule { get; set; } = string.Empty;
+
+        /// <summary>
+        /// The effect rule name for target-aware policies, if applicable.
+        /// This is the specific effect rule (e.g., "effect", "allow", "deny")
+        /// that determines the policy decision for target evaluation.
+        /// </summary>
+        [JsonPropertyName("effect_rule")]
+        public string? EffectRule { get; set; }
+
+        /// <summary>
+        /// Parameters that can be configured for this policy.
+        /// Contains parameter names and their expected types or default values.
+        /// Used for parameterized policies that accept configuration at evaluation time.
+        /// Each element represents parameters from a different module.
+        /// </summary>
+        [JsonPropertyName("parameters")]
+        public List<PolicyParameters> Parameters { get; set; } = new List<PolicyParameters>();
+    }
+
+    /// <summary>
+    /// Parameters that can be configured for a policy.
+    /// </summary>
+    public class PolicyParameters
+    {
+        /// <summary>
+        /// Source file where the parameters are defined.
+        /// </summary>
+        [JsonPropertyName("source_file")]
+        public string SourceFile { get; set; } = string.Empty;
+
+        /// <summary>
+        /// List of parameter definitions.
+        /// </summary>
+        [JsonPropertyName("parameters")]
+        public List<PolicyParameter> Parameters { get; set; } = new List<PolicyParameter>();
+
+        /// <summary>
+        /// List of parameter modifiers.
+        /// </summary>
+        [JsonPropertyName("modifiers")]
+        public List<PolicyParameterModifier> Modifiers { get; set; } = new List<PolicyParameterModifier>();
+    }
+
+    /// <summary>
+    /// A single parameter definition.
+    /// </summary>
+    public class PolicyParameter
+    {
+        /// <summary>
+        /// Name of the parameter.
+        /// </summary>
+        [JsonPropertyName("name")]
+        public string Name { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Type of the parameter.
+        /// </summary>
+        [JsonPropertyName("type")]
+        public string Type { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Default value of the parameter, if any.
+        /// </summary>
+        [JsonPropertyName("default")]
+        public object? Default { get; set; }
+
+        /// <summary>
+        /// Description of the parameter.
+        /// </summary>
+        [JsonPropertyName("description")]
+        public string? Description { get; set; }
+
+        /// <summary>
+        /// Allowed values for the parameter, if constrained.
+        /// </summary>
+        [JsonPropertyName("allowed_values")]
+        public List<object>? AllowedValues { get; set; }
+    }
+
+    /// <summary>
+    /// A parameter modifier that affects parameter behavior.
+    /// </summary>
+    public class PolicyParameterModifier
+    {
+        /// <summary>
+        /// Name of the modifier.
+        /// </summary>
+        [JsonPropertyName("name")]
+        public string Name { get; set; } = string.Empty;
+
+        /// <summary>
+        /// Value of the modifier.
+        /// </summary>
+        [JsonPropertyName("value")]
+        public object? Value { get; set; }
+    }
+}

bindings/csharp/Regorus/Regorus.csproj

@@ -0,0 +1,57 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Library</OutputType>
+        <RootNamespace>Microsoft.Regorus</RootNamespace>
+        <TargetFrameworks>netstandard2.0;netstandard2.1</TargetFrameworks>
+        <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+       <LangVersion>10.0</LangVersion>
+
+        <!-- See https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-pack -->
+        <VersionPrefix>0.7.0</VersionPrefix>
+        <VersionSuffix>$(VersionSuffix)</VersionSuffix>
+        <PackageReadmeFile>README.md</PackageReadmeFile>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="System.Text.Json" Version="8.0.5" />
+    </ItemGroup>
+
+    <!--
+        $(RegorusFFIArtifactsDir) is the location where regorus shared libraries have been
+        built for various platforms and copied to. RegorusFFIArtifactsDir is passed in
+        by the publishing pipeline.
+
+        For each target triple, `Pack` expects the regorus ffi shared library
+        to be found in $(RegorusFFIArtifactsDir)/<target-triple>/release.
+
+        If $(IgnoreMissingArtifacts) is not set, ensure that the binaries for officially supported platforms exists.
+    -->
+    <Target Name="ChecksRegorusFFIArtifactsDir" BeforeTargets="Pack" Condition="'$(IgnoreMissingArtifacts)' == ''">
+        <Error Text="RegorusFFIArtifactsDir must be supplied." Condition="$(RegorusFFIArtifactsDir) == ''" />
+
+        <!-- Ensure that the binaries for officially supported platforms exists. -->
+        <Error Text="$(RegorusFFIArtifactsDir)/x86_64-pc-windows-msvc/release/regorus_ffi.dll missing."
+               Condition="!Exists('$(RegorusFFIArtifactsDir)/x86_64-pc-windows-msvc/release/regorus_ffi.dll')" />
+        <Error Text="$(RegorusFFIArtifactsDir)/x86_64-pc-windows-msvc/release/regorus_ffi.pdb missing."
+               Condition="!Exists('$(RegorusFFIArtifactsDir)/x86_64-pc-windows-msvc/release/regorus_ffi.pdb')" />
+
+        <Error Text="$(RegorusFFIArtifactsDir)/x86_64-unknown-linux-gnu/release/libregorus_ffi.so missing."
+               Condition="!Exists('$(RegorusFFIArtifactsDir)/x86_64-unknown-linux-gnu/release/libregorus_ffi.so')" />
+    </Target>
+
+    <ItemGroup>
+        <None Include="docs/README.md" Pack="true"  PackagePath="/" />
+
+        <!-- Copy each binary to expected location within the package -->
+        <None Include="$(RegorusFFIArtifactsDir)/x86_64-pc-windows-msvc/release/*.dll" Pack="true" PackagePath="runtimes/win-x64/native/" />
+        <None Include="$(RegorusFFIArtifactsDir)/x86_64-pc-windows-msvc/release/*.pdb" Pack="true" PackagePath="runtimes/win-x64/native/" />
+
+        <None Include="$(RegorusFFIArtifactsDir)/aarch64-pc-windows-msvc/release/*.dll" Pack="true" PackagePath="runtimes/win-arm64/native/" />
+        <None Include="$(RegorusFFIArtifactsDir)/aarch64-pc-windows-msvc/release/*.pdb" Pack="true" PackagePath="runtimes/win-arm64/native/" />
+
+        <None Include="$(RegorusFFIArtifactsDir)/x86_64-unknown-linux-gnu/release/lib*.so" Pack="true" PackagePath="runtimes/linux-x64/native/" />
+
+        <None Include="$(RegorusFFIArtifactsDir)/aarch64-apple-darwin/release/lib*.dylib" Pack="true" PackagePath="runtimes/osx-arm64/native/" />
+    </ItemGroup>
+</Project>

bindings/csharp/Regorus/SchemaRegistry.cs

@@ -0,0 +1,284 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Text;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Provides static methods for managing the global resource schema registry.
+    /// Resource schemas define the structure and validation rules for Azure Policy resources.
+    /// </summary>
+    public static unsafe class SchemaRegistry
+    {
+        /// <summary>
+        /// Register a resource schema from JSON with a given name.
+        /// </summary>
+        /// <param name="name">Name to register the schema under</param>
+        /// <param name="schemaJson">JSON string representing the schema</param>
+        /// <exception cref="Exception">Thrown when schema registration fails</exception>
+        public static void RegisterResource(string name, string schemaJson)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            var schemaBytes = Encoding.UTF8.GetBytes(schemaJson + char.MinValue);
+            
+            fixed (byte* namePtr = nameBytes)
+            fixed (byte* schemaPtr = schemaBytes)
+            {
+                CheckAndDropResult(Internal.API.regorus_resource_schema_register(namePtr, schemaPtr));
+            }
+        }
+
+        /// <summary>
+        /// Check if a resource schema with the given name exists.
+        /// </summary>
+        /// <param name="name">Name of the schema to check</param>
+        /// <returns>True if the schema exists, false otherwise</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool ContainsResource(string name)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            fixed (byte* namePtr = nameBytes)
+            {
+                var result = Internal.API.regorus_resource_schema_contains(namePtr);
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Get the number of registered resource schemas.
+        /// </summary>
+        /// <returns>The number of registered resource schemas</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static long ResourceCount
+        {
+            get
+            {
+                var result = Internal.API.regorus_resource_schema_len();
+                return GetIntResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Check if the resource schema registry is empty.
+        /// </summary>
+        /// <returns>True if the registry is empty, false otherwise</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool IsResourceRegistryEmpty
+        {
+            get
+            {
+                var result = Internal.API.regorus_resource_schema_is_empty();
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// List all registered resource schema names.
+        /// </summary>
+        /// <returns>JSON array of schema names</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static string ListResourceNames()
+        {
+            return CheckAndDropResult(Internal.API.regorus_resource_schema_list_names()) ?? "[]";
+        }
+
+        /// <summary>
+        /// Remove a resource schema by name.
+        /// </summary>
+        /// <param name="name">Name of the schema to remove</param>
+        /// <returns>True if the schema was removed, false if it wasn't found</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool RemoveResource(string name)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            fixed (byte* namePtr = nameBytes)
+            {
+                var result = Internal.API.regorus_resource_schema_remove(namePtr);
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Clear all resource schemas from the registry.
+        /// </summary>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static void ClearResources()
+        {
+            CheckAndDropResult(Internal.API.regorus_resource_schema_clear());
+        }
+
+        /// <summary>
+        /// Register an effect schema from JSON with a given name.
+        /// </summary>
+        /// <param name="name">Name to register the schema under</param>
+        /// <param name="schemaJson">JSON string representing the schema</param>
+        /// <exception cref="Exception">Thrown when schema registration fails</exception>
+        public static void RegisterEffect(string name, string schemaJson)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            var schemaBytes = Encoding.UTF8.GetBytes(schemaJson + char.MinValue);
+            
+            fixed (byte* namePtr = nameBytes)
+            fixed (byte* schemaPtr = schemaBytes)
+            {
+                CheckAndDropResult(Internal.API.regorus_effect_schema_register(namePtr, schemaPtr));
+            }
+        }
+
+        /// <summary>
+        /// Check if an effect schema with the given name exists.
+        /// </summary>
+        /// <param name="name">Name of the schema to check</param>
+        /// <returns>True if the schema exists, false otherwise</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool ContainsEffect(string name)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            fixed (byte* namePtr = nameBytes)
+            {
+                var result = Internal.API.regorus_effect_schema_contains(namePtr);
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Get the number of registered effect schemas.
+        /// </summary>
+        /// <returns>The number of registered effect schemas</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static long EffectCount
+        {
+            get
+            {
+                var result = Internal.API.regorus_effect_schema_len();
+                return GetIntResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Check if the effect schema registry is empty.
+        /// </summary>
+        /// <returns>True if the registry is empty, false otherwise</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool IsEffectRegistryEmpty
+        {
+            get
+            {
+                var result = Internal.API.regorus_effect_schema_is_empty();
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// List all registered effect schema names.
+        /// </summary>
+        /// <returns>JSON array of schema names</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static string ListEffectNames()
+        {
+            return CheckAndDropResult(Internal.API.regorus_effect_schema_list_names()) ?? "[]";
+        }
+
+        /// <summary>
+        /// Remove an effect schema by name.
+        /// </summary>
+        /// <param name="name">Name of the schema to remove</param>
+        /// <returns>True if the schema was removed, false if it wasn't found</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool RemoveEffect(string name)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            fixed (byte* namePtr = nameBytes)
+            {
+                var result = Internal.API.regorus_effect_schema_remove(namePtr);
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Clear all effect schemas from the registry.
+        /// </summary>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static void ClearEffects()
+        {
+            CheckAndDropResult(Internal.API.regorus_effect_schema_clear());
+        }
+
+        private static string? StringFromUTF8(IntPtr ptr)
+        {
+#if NETSTANDARD2_1
+            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
+#else
+            int len = 0;
+            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
+            byte[] buffer = new byte[len];
+            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
+            return Encoding.UTF8.GetString(buffer);
+#endif
+        }
+
+        private static string? CheckAndDropResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type switch
+                {
+                    Internal.RegorusDataType.String => StringFromUTF8((IntPtr)result.output),
+                    Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
+                    Internal.RegorusDataType.Integer => result.int_value.ToString(),
+                    Internal.RegorusDataType.None => null,
+                    _ => StringFromUTF8((IntPtr)result.output)
+                };
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+
+        private static bool GetBoolResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type == Internal.RegorusDataType.Boolean ? result.bool_value : false;
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+
+        private static long GetIntResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type == Internal.RegorusDataType.Integer ? result.int_value : 0;
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+    }
+}

bindings/csharp/Regorus/TargetRegistry.cs

@@ -0,0 +1,185 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Text;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Provides static methods for managing the global target registry.
+    /// Targets define resource types and their associated schemas for Azure Policy evaluation.
+    /// </summary>
+    public static unsafe class TargetRegistry
+    {
+        /// <summary>
+        /// Register a target from JSON definition.
+        /// The target JSON should follow the target schema format.
+        /// Once registered, the target can be referenced in Rego policies using `__target__` rules.
+        /// </summary>
+        /// <param name="targetJson">JSON encoded target definition</param>
+        /// <exception cref="Exception">Thrown when target registration fails</exception>
+        public static void RegisterFromJson(string targetJson)
+        {
+            var targetBytes = Encoding.UTF8.GetBytes(targetJson + char.MinValue);
+            fixed (byte* targetPtr = targetBytes)
+            {
+                CheckAndDropResult(Internal.API.regorus_register_target_from_json(targetPtr));
+            }
+        }
+
+        /// <summary>
+        /// Check if a target is registered.
+        /// </summary>
+        /// <param name="name">Name of the target to check</param>
+        /// <returns>True if the target is registered, false otherwise</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool Contains(string name)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            fixed (byte* namePtr = nameBytes)
+            {
+                var result = Internal.API.regorus_target_registry_contains(namePtr);
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Get a list of all registered target names.
+        /// </summary>
+        /// <returns>JSON array of target names</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static string ListNames()
+        {
+            return CheckAndDropResult(Internal.API.regorus_target_registry_list_names()) ?? "[]";
+        }
+
+        /// <summary>
+        /// Remove a target from the registry by name.
+        /// </summary>
+        /// <param name="name">The target name to remove</param>
+        /// <returns>True if the target was removed, false if it wasn't found</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool Remove(string name)
+        {
+            var nameBytes = Encoding.UTF8.GetBytes(name + char.MinValue);
+            fixed (byte* namePtr = nameBytes)
+            {
+                var result = Internal.API.regorus_target_registry_remove(namePtr);
+                return GetBoolResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Clear all targets from the registry.
+        /// </summary>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static void Clear()
+        {
+            CheckAndDropResult(Internal.API.regorus_target_registry_clear());
+        }
+
+        /// <summary>
+        /// Get the number of registered targets.
+        /// </summary>
+        /// <returns>The number of registered targets</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static long Count
+        {
+            get
+            {
+                var result = Internal.API.regorus_target_registry_len();
+                return GetIntResult(result);
+            }
+        }
+
+        /// <summary>
+        /// Check if the target registry is empty.
+        /// </summary>
+        /// <returns>True if the registry is empty, false otherwise</returns>
+        /// <exception cref="Exception">Thrown when the operation fails</exception>
+        public static bool IsEmpty
+        {
+            get
+            {
+                var result = Internal.API.regorus_target_registry_is_empty();
+                return GetBoolResult(result);
+            }
+        }
+
+        private static string? StringFromUTF8(IntPtr ptr)
+        {
+#if NETSTANDARD2_1
+            return System.Runtime.InteropServices.Marshal.PtrToStringUTF8(ptr);
+#else
+            int len = 0;
+            while (System.Runtime.InteropServices.Marshal.ReadByte(ptr, len) != 0) { ++len; }
+            byte[] buffer = new byte[len];
+            System.Runtime.InteropServices.Marshal.Copy(ptr, buffer, 0, buffer.Length);
+            return Encoding.UTF8.GetString(buffer);
+#endif
+        }
+
+        private static string? CheckAndDropResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type switch
+                {
+                    Internal.RegorusDataType.String => StringFromUTF8((IntPtr)result.output),
+                    Internal.RegorusDataType.Boolean => result.bool_value.ToString().ToLowerInvariant(),
+                    Internal.RegorusDataType.Integer => result.int_value.ToString(),
+                    Internal.RegorusDataType.None => null,
+                    _ => StringFromUTF8((IntPtr)result.output)
+                };
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+
+        private static bool GetBoolResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type == Internal.RegorusDataType.Boolean ? result.bool_value : false;
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+
+        private static long GetIntResult(Internal.RegorusResult result)
+        {
+            try
+            {
+                if (result.status != Internal.RegorusStatus.Ok)
+                {
+                    var message = StringFromUTF8((IntPtr)result.error_message);
+                    throw new Exception(message ?? "Unknown error occurred");
+                }
+
+                return result.data_type == Internal.RegorusDataType.Integer ? result.int_value : 0;
+            }
+            finally
+            {
+                Internal.API.regorus_result_drop(result);
+            }
+        }
+    }
+}

bindings/csharp/Regorus/docs/README.md

@@ -0,0 +1 @@
+C# Bindings for Regorus

bindings/csharp/TargetExampleApp/Program.cs

@@ -0,0 +1,291 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System.Text.Json;
+
+namespace TargetExampleApp;
+
+class Program
+{
+    // Policy definition constants
+    private const string AZURE_STORAGE_POLICY_DEFINITION = @"
+package policy
+
+import rego.v1
+
+# Target declaration for Azure Policy
+__target__ := ""target.tests.azure_policy""
+
+default parameters.requiredTLSVersion = """"
+default parameters.allowedPorts = []
+
+# Policy rules for storage accounts
+default allow := false
+
+# Allow storage accounts with HTTPS-only traffic and proper encryption
+allow if {
+    input.type == ""Microsoft.Storage/storageAccounts""
+    input.properties.supportsHttpsTrafficOnly == true
+    input.properties.encryption.services.blob.enabled == true
+    input.properties.minimumTlsVersion in [parameters.requiredTLSVersion]
+}
+
+# Allow network security groups with proper inbound rules
+allow if {
+    input.type == ""Microsoft.Network/networkSecurityGroups""
+    count([rule | 
+        rule := input.properties.securityRules[_]
+        rule.properties.direction == ""Inbound""
+        rule.properties.access == ""Allow""
+        rule.properties.sourceAddressPrefix == ""*""
+        rule.properties.destinationPortRange in [parameters.allowedPorts]
+    ]) == 0
+}";
+
+    private const string AZURE_STORAGE_POLICY_ASSIGNMENT = @"
+package policy
+
+import rego.v1
+
+parameters.requiredTLSVersion = ""TLS1_2""
+parameters.allowedPorts = [""22"", ""3389""]";
+
+    // Test data constants
+    private const string COMPLIANT_STORAGE_ACCOUNT = @"{
+  ""type"": ""Microsoft.Storage/storageAccounts"",
+  ""name"": ""compliantstorageacct"",
+  ""location"": ""eastus"",
+  ""kind"": ""StorageV2"",
+  ""properties"": {
+    ""supportsHttpsTrafficOnly"": true,
+    ""minimumTlsVersion"": ""TLS1_2"",
+    ""allowBlobPublicAccess"": false,
+    ""encryption"": {
+      ""services"": {
+        ""blob"": { ""enabled"": true },
+        ""file"": { ""enabled"": true }
+      }
+    }
+  },
+  ""tags"": {
+    ""environment"": ""production""
+  }
+}";
+
+    private const string NON_COMPLIANT_STORAGE_ACCOUNT = @"{
+  ""type"": ""Microsoft.Storage/storageAccounts"",
+  ""name"": ""insecurestorageacct"",
+  ""location"": ""westus"",
+  ""kind"": ""Storage"",
+  ""properties"": {
+    ""supportsHttpsTrafficOnly"": false,
+    ""minimumTlsVersion"": ""TLS1_0"",
+    ""allowBlobPublicAccess"": true,
+    ""encryption"": {
+      ""services"": {
+        ""blob"": { ""enabled"": false },
+        ""file"": { ""enabled"": false }
+      }
+    }
+  }
+}";
+
+    static void Main(string[] args)
+    {
+        Console.WriteLine("=== Regorus Target Example Application ===\n");
+
+        try
+        {
+            DemonstrateTargetFunctionality();
+            Console.WriteLine("\n=== Target demonstration completed successfully! ===");
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"Error: {ex.Message}");
+            Environment.Exit(1);
+        }
+    }
+
+    static void DemonstrateTargetFunctionality()
+    {
+        Console.WriteLine("REGORUS TARGET FUNCTIONALITY DEMONSTRATION");
+        Console.WriteLine("==========================================");
+
+        // 1. Register target using JSON from file
+        var targetJsonPath = Path.Combine(AppContext.BaseDirectory, "azure_policy.target.json");
+        var targetJson = File.ReadAllText(targetJsonPath);
+
+        Console.WriteLine("1. Registering target from JSON file:");
+        Console.WriteLine(targetJson);
+
+        Regorus.TargetRegistry.RegisterFromJson(targetJson);
+        Console.WriteLine($"Target registered. Registry contains {Regorus.TargetRegistry.Count} target(s)");
+        Console.WriteLine($"Registered targets: {Regorus.TargetRegistry.ListNames()}");
+
+        // 2. Compile policy for target
+        var policyModules = new List<Regorus.PolicyModule>
+        {
+            new Regorus.PolicyModule($"definition-{Guid.NewGuid():N}", AZURE_STORAGE_POLICY_DEFINITION),
+            new Regorus.PolicyModule($"assignment-{Guid.NewGuid():N}", AZURE_STORAGE_POLICY_ASSIGNMENT)
+        };
+
+        var policyDataJson = "{}";
+
+        Console.WriteLine("\n2. Compiling policy for target...");
+        using var compiledPolicy = Regorus.Compiler.CompilePolicyForTarget(policyDataJson, policyModules);
+        Console.WriteLine("Policy compiled successfully!");
+
+        // 2.5. Demonstrate policy information retrieval
+        Console.WriteLine("\n2.5. Retrieving policy information:");
+        DemonstratePolicyInfo(compiledPolicy);
+
+        // 3. Evaluate with different inputs
+        Console.WriteLine("\n3. Testing policy evaluation:");
+        Console.WriteLine("Compliant storage account:");
+        Console.WriteLine(COMPLIANT_STORAGE_ACCOUNT);
+
+        var compliantResult = compiledPolicy.EvalWithInput(COMPLIANT_STORAGE_ACCOUNT);
+        Console.WriteLine($"Result: {compliantResult}");
+
+        Console.WriteLine("\nNon-compliant storage account:");
+        Console.WriteLine(NON_COMPLIANT_STORAGE_ACCOUNT);
+
+        var nonCompliantResult = compiledPolicy.EvalWithInput(NON_COMPLIANT_STORAGE_ACCOUNT);
+        Console.WriteLine($"Result: {nonCompliantResult}");
+        
+        // 4. Demonstrate thread-safe concurrent evaluation
+        Console.WriteLine("\n4. Testing concurrent evaluation from multiple threads:");
+        DemonstrateConcurrentEvaluation(compiledPolicy);
+    }
+
+    static void DemonstrateConcurrentEvaluation(Regorus.CompiledPolicy compiledPolicy)
+    {
+        var testInputs = new[]
+        {
+            ("Thread-1-Compliant", COMPLIANT_STORAGE_ACCOUNT),
+            ("Thread-2-NonCompliant", NON_COMPLIANT_STORAGE_ACCOUNT),
+            ("Thread-3-Compliant", COMPLIANT_STORAGE_ACCOUNT.Replace("compliantstorageacct", "thread3storage")),
+            ("Thread-4-NonCompliant", NON_COMPLIANT_STORAGE_ACCOUNT.Replace("insecurestorageacct", "thread4storage")),
+            ("Thread-5-Compliant", COMPLIANT_STORAGE_ACCOUNT.Replace("compliantstorageacct", "thread5storage"))
+        };
+
+        Console.WriteLine($"Starting {testInputs.Length} concurrent evaluations...");
+        
+        var tasks = testInputs.Select(input => 
+            Task.Run(() => {
+                var (threadName, json) = input;
+                var stopwatch = System.Diagnostics.Stopwatch.StartNew();
+                
+                // Multiple evaluations per thread to stress test
+                var results = new List<string>();
+                for (int i = 0; i < 1000; i++)
+                {
+                    var result = compiledPolicy.EvalWithInput(json);
+                    results.Add(result);
+                }
+                
+                stopwatch.Stop();
+                var microseconds = stopwatch.ElapsedTicks * 1000000 / System.Diagnostics.Stopwatch.Frequency;
+                
+                // Verify all results are identical (thread safety)
+                var firstResult = results[0];
+                var allIdentical = results.All(r => r == firstResult);
+                
+                Console.WriteLine($"✓ {threadName}: {results.Count} evaluations in {microseconds}μs, " +
+                                $"Results consistent: {allIdentical}");
+                
+                return (threadName, results.Count, microseconds, allIdentical);
+            })
+        ).ToArray();
+
+        // Wait for all threads to complete
+        var results = Task.WhenAll(tasks).Result;
+        
+        Console.WriteLine("\nConcurrency test results:");
+        var totalEvaluations = results.Sum(r => r.Item2);
+        var maxTime = results.Max(r => r.Item3);
+        var allConsistent = results.All(r => r.allIdentical);
+        
+        Console.WriteLine($"✓ Total evaluations: {totalEvaluations}");
+        Console.WriteLine($"✓ Max thread time: {maxTime}μs");
+        Console.WriteLine($"✓ All threads consistent: {allConsistent}");
+        Console.WriteLine($"✓ Approximate throughput: {totalEvaluations * 1000000.0 / maxTime:F0} evaluations/second");
+        Console.WriteLine("✓ No locks required - CompiledPolicy is thread-safe!");
+    }
+
+    static void DemonstratePolicyInfo(Regorus.CompiledPolicy compiledPolicy)
+    {
+        Console.WriteLine("Getting policy metadata using GetPolicyInfo()...");
+        
+        try
+        {
+            var policyInfo = compiledPolicy.GetPolicyInfo();
+            
+            Console.WriteLine($"✓ Policy Information Retrieved:");
+            Console.WriteLine($"  Target Name: {policyInfo.TargetName ?? "None"}");
+            Console.WriteLine($"  Effect Rule: {policyInfo.EffectRule ?? "None"}");
+            Console.WriteLine($"  Entrypoint Rule: {policyInfo.EntrypointRule}");
+            
+            Console.WriteLine($"  Module IDs ({policyInfo.ModuleIds.Count}):");
+            foreach (var moduleId in policyInfo.ModuleIds)
+            {
+                Console.WriteLine($"    - {moduleId}");
+            }
+            
+            Console.WriteLine($"  Applicable Resource Types ({policyInfo.ApplicableResourceTypes.Count}):");
+            foreach (var resourceType in policyInfo.ApplicableResourceTypes)
+            {
+                Console.WriteLine($"    - {resourceType}");
+            }
+            
+            if (policyInfo.Parameters != null && policyInfo.Parameters.Count > 0)
+            {
+                Console.WriteLine($"  Policy Parameters:");
+                foreach (var parameterSet in policyInfo.Parameters)
+                {
+                    Console.WriteLine($"    From '{parameterSet.SourceFile}':");
+                    Console.WriteLine($"      Parameters ({parameterSet.Parameters.Count}):");
+                    foreach (var param in parameterSet.Parameters)
+                    {
+                        Console.WriteLine($"        - {param.Name} ({param.Type})");
+                        if (param.Default != null)
+                        {
+                            Console.WriteLine($"          Default: {param.Default}");
+                        }
+                        if (!string.IsNullOrEmpty(param.Description))
+                        {
+                            Console.WriteLine($"          Description: {param.Description}");
+                        }
+                    }
+                    
+                    if (parameterSet.Modifiers.Count > 0)
+                    {
+                        Console.WriteLine($"      Modifiers ({parameterSet.Modifiers.Count}):");
+                        foreach (var modifier in parameterSet.Modifiers)
+                        {
+                            Console.WriteLine($"        - {modifier.Name}: {modifier.Value}");
+                        }
+                    }
+                }
+            }
+            else
+            {
+                Console.WriteLine("  No parameter information available");
+            }
+            
+            // Demonstrate JSON serialization of policy info
+            Console.WriteLine("\n✓ Policy Info as JSON:");
+            var jsonOptions = new JsonSerializerOptions 
+            { 
+                WriteIndented = true,
+                PropertyNamingPolicy = JsonNamingPolicy.CamelCase
+            };
+            var policyInfoJson = JsonSerializer.Serialize(policyInfo, jsonOptions);
+            Console.WriteLine(policyInfoJson);
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"✗ Failed to get policy info: {ex.Message}");
+        }
+    }
+}

bindings/csharp/TargetExampleApp/TargetExampleApp.csproj

@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+
+  <PropertyGroup>
+    <!-- If the environment variable is set (such as in a Github Action run), append the suffix to the version number -->
+    <RegorusPackageVersionSuffix Condition="'$(VersionSuffix)' != ''">-$(VersionSuffix)</RegorusPackageVersionSuffix>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Regorus" Version="0.6.0$(RegorusPackageVersionSuffix)"/>
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Include="azure_policy.target.json">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
+  </ItemGroup>
+
+</Project>

bindings/csharp/TargetExampleApp/azure_policy.target.json

@@ -0,0 +1,125 @@
+{
+  "name": "target.tests.azure_policy",
+  "description": "Azure Policy target for comprehensive policy evaluation testing",
+  "version": "1.0.0",
+  "resource_schema_selector": "type",
+  "resource_schemas": [
+    {
+      "type": "object",
+      "properties": {
+        "type": { "const": "Microsoft.Resources/subscriptions" },
+        "subscriptionId": { "type": "string" },
+        "tenantId": { "type": "string" },
+        "displayName": { "type": "string" }
+      },
+      "required": ["type", "subscriptionId"]
+    },
+    {
+      "type": "object", 
+      "properties": {
+        "type": { "const": "Microsoft.Storage/storageAccounts" },
+        "name": { "type": "string" },
+        "location": { "type": "string" },
+        "kind": { "enum": ["Storage", "StorageV2", "BlobStorage", "FileStorage", "BlockBlobStorage"] },
+        "properties": {
+          "type": "object",
+          "properties": {
+            "supportsHttpsTrafficOnly": { "type": "boolean" },
+            "minimumTlsVersion": { "enum": ["TLS1_0", "TLS1_1", "TLS1_2"] },
+            "allowBlobPublicAccess": { "type": "boolean" },
+            "encryption": {
+              "type": "object",
+              "properties": {
+                "services": {
+                  "type": "object",
+                  "properties": {
+                    "blob": { "type": "object", "properties": { "enabled": { "type": "boolean" } } },
+                    "file": { "type": "object", "properties": { "enabled": { "type": "boolean" } } }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "tags": { "type": "object" }
+      },
+      "required": ["type", "name", "location"]
+    },
+    {
+      "type": "object",
+      "properties": {
+        "type": { "const": "Microsoft.Network/networkSecurityGroups" },
+        "name": { "type": "string" },
+        "location": { "type": "string" },
+        "properties": {
+          "type": "object",
+          "properties": {
+            "securityRules": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "name": { "type": "string" },
+                  "properties": {
+                    "type": "object",
+                    "properties": {
+                      "direction": { "enum": ["Inbound", "Outbound"] },
+                      "access": { "enum": ["Allow", "Deny"] },
+                      "protocol": { "enum": ["Tcp", "Udp", "*"] },
+                      "sourcePortRange": { "type": "string" },
+                      "destinationPortRange": { "type": "string" },
+                      "sourceAddressPrefix": { "type": "string" },
+                      "destinationAddressPrefix": { "type": "string" },
+                      "priority": { "type": "integer", "minimum": 100, "maximum": 4096 }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "required": ["type", "name", "location"]
+    }
+  ],
+  "effects": {
+    "allow": { "type": "boolean" },
+    "deny": {
+      "type": "object",
+      "properties": {
+        "message": { "type": "string" }
+      }
+    },
+    "audit": {
+      "type": "object",
+      "properties": {
+        "level": { "enum": ["info", "warning", "error"] },
+        "message": { "type": "string" },
+        "complianceState": { "enum": ["Compliant", "NonCompliant", "Unknown"] }
+      }
+    },
+    "modify": {
+      "type": "object",
+      "properties": {
+        "operations": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "operation": { "enum": ["add", "replace", "remove"] },
+              "field": { "type": "string" },
+              "value": { "type": "any" }
+            }
+          }
+        }
+      }
+    },
+    "deployIfNotExists": {
+      "type": "object",
+      "properties": {
+        "template": { "type": "object" },
+        "parameters": { "type": "object" }
+      }
+    }
+  }
+}

bindings/csharp/TestApp/Program.cs

@@ -0,0 +1,82 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System.Diagnostics;
+
+
+long nanosecPerTick = (1000L * 1000L * 1000L) / Stopwatch.Frequency;
+var w = new Stopwatch();
+
+
+// Force load of modules.
+{
+    var _e = new Regorus.Engine();
+#if NET8_0_OR_GREATER
+    var _j = System.Text.Json.JsonDocument.Parse("{}");
+#endif
+}
+
+w.Restart();
+
+var engine = new Regorus.Engine();
+engine.SetRegoV0(true);
+
+w.Stop();
+var newEngineTicks = w.ElapsedTicks;
+
+
+w.Restart();
+
+// Load policies and data.
+engine.AddPolicyFromFile("../../../tests/aci/framework.rego");
+engine.AddPolicyFromFile("../../../tests/aci/api.rego");
+engine.AddPolicyFromFile("../../../tests/aci/policy.rego");
+engine.AddDataFromJsonFile("../../../tests/aci/data.json");
+
+
+w.Stop();
+var loadPoliciesTicks = w.ElapsedTicks;
+
+
+w.Restart();
+
+// Set input and eval rule.
+engine.SetInputFromJsonFile("../../../tests/aci/input.json");
+var value = engine.EvalRule("data.framework.mount_overlay");
+
+#if NET8_0_OR_GREATER
+var valueDoc = System.Text.Json.JsonDocument.Parse(value);
+
+w.Stop();
+var evalTicks = w.ElapsedTicks;
+
+Console.WriteLine("{0}", valueDoc);
+#else
+w.Stop();
+var evalTicks = w.ElapsedTicks;
+#endif
+
+
+Console.WriteLine("Engine creation took {0} msecs", (newEngineTicks * nanosecPerTick) / (1000.0 * 1000.0));
+Console.WriteLine("Load policies and data took {0} msecs", (loadPoliciesTicks * nanosecPerTick) / (1000.0 * 1000.0));
+Console.WriteLine("EvalRule took {0} msecs", (evalTicks * nanosecPerTick) / (1000.0 * 1000.0));
+
+engine = new Regorus.Engine();
+engine.AddPolicy(
+  "test.rego",
+  "package test\nx = 1\nmessage = `Hello`");
+
+engine.SetEnableCoverage(true);
+Console.WriteLine("data.test.message: {0}", engine.EvalRule("data.test.message"));
+Console.WriteLine("Coverage Report:\n{0}", engine.GetCoverageReportPretty());
+
+if (engine.EvalRule("data.test.message") != "\"Hello\"")
+{
+    Console.WriteLine("Failure.");
+    System.Environment.Exit(1);
+}
+else
+{
+    Console.WriteLine("Success.");
+}
+