APL: configuring enforcement pipelines on Praxis

APL: configuring enforcement pipelines on Praxishttps://praxis.fast/policy/dev/apl/Recent content in APL: configuring enforcement pipelines on PraxisHugoenAPL Grammarhttps://praxis.fast/policy/dev/apl/apl-grammar/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/apl-grammar/This document defines the accepted grammar for APL (Authorization Policy Layer).Backend Restrictionhttps://praxis.fast/policy/dev/apl/restrict/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/restrict/Some controls are not about whether an operation runs, but where it runs.Delegation and Token Exchangehttps://praxis.fast/policy/dev/apl/delegation/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/delegation/When PPE forwards an operation to a backend, the backend needs a credential.Effects and Sequencinghttps://praxis.fast/policy/dev/apl/effects/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/effects/An APL rule does something. That something is an effect. Effects are the building blocks of policy: a pre_invocation: block is an ordered list of them, and they run in sequence until one denies.Human-in-the-Loop Elicitationhttps://praxis.fast/policy/dev/apl/elicitation/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/elicitation/Some operations should not proceed on the caller’s say-so alone.Identity and IdP Integrationhttps://praxis.fast/policy/dev/apl/identity/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/identity/Policy reads attributes: role.hr, perm.view_ssn, subject.id.PDP Integrationhttps://praxis.fast/policy/dev/apl/pdp/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/pdp/APL predicates handle attribute checks well: roles, permissions, scopes, comparisons.Session Taint and Information Flowhttps://praxis.fast/policy/dev/apl/tainting/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/tainting/Carry sensitivity labels across requests in a session, then deny later operations that would expose tainted data.Static Attributeshttps://praxis.fast/policy/dev/apl/attributes/Mon, 01 Jan 0001 00:00:00 +0000https://praxis.fast/policy/dev/apl/attributes/Policy reads attributes. Most come from the request: the verified subject and its roles (Identity), request headers, session labels.