🚧 PEP — your policy, actually enforced

The Policy PDP lab only ever evaluates a query you hand it. This is the difference: a REAL enforcement point that gates a real (demo) resource, using the SAME rules you author on that page.

Learn → Policy as code — externalizing decisions Learn → Scopes, consent & least privilege by design Learn → Identity verification — proving there’s a real person

The one rule a PEP can never break

A Policy Enforcement Point must NEVER let the caller assert their own authorization-relevant attributes. Every field the decision below is run against is built entirely server-side: your subject.id comes from your session, your subject.clearance comes from your OWN latest identity verification result, and each resource's classification/owner come from a fixed catalog the server defines (PEP_RESOURCES, which this page can only read) — never from anything you send. You only ever get to name which resource and action you want; you can't lie your way into a decision that trusts you.