📜 Policy PDP lab
Externalized authorization (OPA/Cedar-style). The app is the PEP: it sends a query, this PDP evaluates YOUR declarative rules, and returns an explainable allow/deny decision.
A rule is { effect, priority, description, conditions }.
It matches when ALL of its conditions hold against your query's input document. Default deny: no matching rule
means refused. Deny-overrides: if ANY matching rule denies, the decision is
deny — even if another rule allows. This is NOT fga.ts's relationship-graph Check, and NOT
tool-policy.ts's first-match tool-call gate — it's a general PDP over an arbitrary document.
priority cannot change a decision here, and that
is worth saying out loud because it means the opposite on /mcp. Default-deny plus deny-overrides is
order-independent by construction: every matching rule is consulted, so one deny is enough no
matter where it sits. Priority only fixes the order rules are EVALUATED AND REPORTED in
(ascending, ties broken by id), which is what makes the trace below stable and readable — and
which rule gets called "the first match". A tool policy on /mcp is the other model entirely:
there the first match ends the evaluation, so priority is the whole game.