Settings

How the authorization engine evaluates decisions, and where to configure related controls.

Evaluation model

The order and semantics used to reach a decision.

Deny wins

An explicit deny from any matching policy overrides every allow.

Priority ordering

ABAC policies evaluate in descending priority; default is deny.

Composed engines

The unified PDP resolves RBAC (permissions) and ReBAC (relationships) together.

Explainability

Every engine returns a grant-path / trace when explain is requested.

Security policy

tenant policy

IP allow/deny lists, session limits, and MFA enforcement.

Access Tester

diagnostics

Run an ad-hoc RBAC check with the full grant path.