Central Authorization Engine
The single decision point for every protected action. Requests are evaluated deny-by-default through three ordered stages — RBAC + hierarchical scope, temporary time-boxed grants, then declarative ABAC policy (country, company, branch, transaction value, approval and risk). Policies are data, never code, and every decision is explainable.
Decision Evaluator
Simulate a request and inspect the full explainable trace.
Policies
New and edited policies land in draft. Activation requires a different admin than the last editor (maker/checker).
Loading policies…
Temporary Grants
Time-boxed permissions. A grant can satisfy a missing permission but never widens scope, and always expires.
No temporary grants.
Recent Decisions
Every evaluation is recorded to the audit trail.
No decisions recorded yet.
Enforcement is server-side at every call site — the client never decides access. Policies contain no executable code: each condition is drawn from a fixed operator and attribute vocabulary and validated before it can be activated. Decisions are explainable, carrying the ordered evaluation trace, the governing policy version, and a stable reason code.