Beta

Create a tenant

A new tenant starts with its own users, OAuth settings, audit history and logs. You are its first Tenant Admin.

Policy playground

Write authorization rules, describe a request, and watch a decision point evaluate every rule, combine them and explain its decision.

Simulation. The playground uses the fictional Tidewell Gazette newsroom from the Evaluating a policy lesson and its illustrative rule format, which is a way to show the ideas, not a real policy language. Nothing is sent or stored.

Policy and request

Choosing an example replaces the request below. Edit either box to try your own.

How matching rules that disagree are settled. When no rule permits, the answer is deny.

Each rule starts with a # line naming it, then permit, forbid or on permit and its actions, then when and and lines. A forbid can add reason "text". An on permit rule adds require and suggest instructions to a permit.

JSON with subject, action, resource and environment. A rule that reads a missing attribute cannot be evaluated, which the trace shows as an error.

The rule format

A condition compares two values with is, is not, in, not in, is before or is after. A value is an attribute such as resource.status or environment.device.managed, quoted text, a number, true, false or a list such as ["draft", "approved"]. is before and is after compare dates and times such as "2026-06-14T14:00:00Z". A rule matches when the request's action is one of its actions (or the rule names *) and all of its conditions are true.

We value your privacy

We use cookies and similar technologies to enhance your browsing experience, and analytics to understand our traffic. By clicking "Allow all", you consent to optional analytics. Cookie Policy
Tools