Policy language

A policy is an ordered list of rules for a decision point. First match wins; otherwise the default outcome.

{"decision_point": "verify.decide", "default_outcome": "REVIEW", "rules": [
  {"name": "hard-fail", "when": {"any": [
      {"fact": "document.tamper", "op": "eq", "value": "fail"},
      {"fact": "biometric.liveness", "op": "eq", "value": "fail"}]}, "then": "DENY"},
  {"name": "verified", "when": {"all": [
      {"fact": "document.authenticity", "op": "eq", "value": "pass"},
      {"fact": "biometric.face_similarity", "op": "gte", "value": 0.8},
      {"fact": "risk.score", "op": "lt", "value": 40}]}, "then": "ALLOW"}]}

Operators: eq, ne, gt, gte, lt, lte, in, not_in, contains, not_contains, exists, missing, matches, starts_with. Nodes: all, any, not. Simulate against sample facts or dry-run against past decisions before activating.

Default deny

A decision point resolves to your active policy, else Authpermit's built-in default for that point, else a platform policy, else DENY (policy key platform.default_deny). A missing policy never becomes an allow. Every refused decision is recorded, including the ones made on every command (access.decide).

Obligations and constraints

A rule may carry "obligations" (e.g. ["watermark", {"type": "log_everything"}]) and "constraints" (e.g. {"max_records": 100}). They come back on the decision for the caller to enforce, with the ones the outcome implies: STEP_UP → step_up, REVIEW → approval, MONITOR → notify.

Risk

Authorization adds the latest platform risk of the acting subject and of the resource as risk.subject.score, risk.resource.score and the highest as risk.score. Unknown risk is absent, never zero.