← All practicals

Externalize an authorization decision (PDP/PEP)

Author declarative policy rules, then watch deny-overrides win even for the resource’s own owner.

1. 1

   Open the Policy lab — a starter policy is seeded for you.

   Three rules ship day one: an ownership allow (`resource.owner sameAs subject.id`), a guest-read-only allow, and a deny for restricted resources without high clearance — policy as DATA the PDP interprets, never code the app hardcodes.

2. 2

   Run a query where the subject owns a non-restricted resource.

   Only the ownership rule matches and nothing denies it — ALLOW, explained by exactly which rule granted it.

3. 3

   Run the SAME ownership query, but set the resource’s classification to “restricted” and the subject’s clearance to anything but “high”.

   Now TWO rules match — your own ownership allow AND the restricted-resource deny. Deny-overrides means the deny wins regardless of priority order: the safe default for a general-purpose PDP, unlike a first-match ACL.

4. 4

   Author your own rule (any effect, any condition) and re-run a query it should affect.

   Policy-as-code means an owner changes authorization behavior by writing DATA, never by redeploying the app — the same evaluator interprets whatever rules you give it.