worked poc

app/policy.py

@@ -32,9 +32,6 @@ class PolicyEngine:
         except (TypeError, ValueError):
             return Decision(False, None, "missing or invalid severity")
 
-        if severity > self.max_severity:
-            return Decision(False, None, f"severity {severity} is below block threshold")
-
         src = _ip(event.get("src_ip"))
         dst = _ip(event.get("dest_ip"))
         if src is None or dst is None:
@@ -52,6 +49,8 @@ class PolicyEngine:
             return Decision(False, str(target), "remote endpoint is on NEVER_BLOCK list")
         if not self.auto_block:
             return Decision(False, str(target), "observation mode: AUTO_BLOCK=false")
+        if severity > self.max_severity:
+            return Decision(False, str(target), f"severity {severity} is below block threshold")
         return Decision(True, str(target), f"severity {severity} matched automatic block policy")
 
     def _is_monitored(self, address: ipaddress._BaseAddress) -> bool: