← All explainers
Learn
One decision point for every permission
Every service asks the same policy decision point whether an action is allowed, and every answer carries its reason. There is no second, quieter path to the data.
One question, asked everywhere
Each service authorizes each action through a single decision endpoint, against one catalog of permissions in the form pillar:type:action.
Every no has a reason
A denial returns the reason and the policy that made it, so a refusal can be explained rather than guessed at.
Closed when in doubt
If the decision point cannot be reached, the answer is no.
Ask it questions
Simulate a change before it ships, ask who can act on a resource, or ask what a principal can do.