# DecisioQ sandbox implementation specification

## Current state

A genuine isolated DecisioQ sandbox is not currently represented by the API Consumer `Environment` value. `Not specified`, `Sandbox`, and `Production` are informational labels only; they do not change routing, credentials, data, quotas, billing, authorization, or decision behavior.

## Minimum viable sandbox

A real sandbox should provide:

- a distinct hostname and deployment boundary;
- separate credentials, signing configuration, data stores, telemetry, quotas, and usage ledger;
- no production data and no ability for sandbox credentials to reach production;
- stable, versioned test decisions and deterministic golden request/response fixtures;
- explicit non-billing or sandbox-credit rules;
- safe synthetic data and reset capability;
- published availability expectations and support ownership;
- promotion guidance describing differences between sandbox and production.

## Acceptance tests

1. A sandbox token is rejected by production and a production token is rejected by sandbox.
2. Sandbox decisions never appear in the production usage ledger.
3. Golden fixtures return the documented deterministic result.
4. Sandbox data and logs are stored separately from production.
5. Rotation or revocation in one environment cannot affect credentials in the other.

Until these checks pass, documentation and UI must describe Environment as informational, not as a functioning sandbox selector.