Relationship and Context Authorization

authorization_model · administer · evaluate · compose · enforce

policy sourcescomposite PDPevaluation enginesenforcement points

The target decision is the intersection of authenticated identity, durable relationships, trusted resource/action context, active delegation, and enforceable obligations. Relationship evaluation is Implemented. Contextual OPA evaluation and the full obligation contract are Planned.

Responsibility split

Role	Component	Owns	Does not own
PAP	dx-acl-go	Grant authoring, versions, constraints, expiry, revocation	Request-time decisions
Relationship engine	OpenFGA	Tuples, relationship model, graph evaluation	Authentication, business records, contextual rules
Context engine	OPA — Planned	Policy over trusted attributes, reason codes, obligations	Relationship source data or enforcement
Composite PDP	dx-authz-go	Input validation, engine calls, composition, stable response	Policy administration or business effects
PEP	Gateway/service/MCP/data executor	Decision and obligation enforcement	Changing policy meaning

Input construction

A PEP resolves canonical inputs before asking for a decision:

• subject, optional actor/delegation chain, workload caller, and organisation;
• action and decision profile;
• canonical resource type, ID, owner, organisation, classification, and available access modes;
• request purpose, risk, time, network/device facts, and trace/request IDs;
• policy/relationship version requirements where the operation is revocation-sensitive.

Caller-provided attributes are never trusted merely because they are present. The gateway may decide a route action, while the service must decide again after it resolves object ownership or classification.

Composition

authenticated principal
AND required OpenFGA relationships
AND OPA contextual policy
AND active delegation and agent state when an actor is present
AND every returned obligation is supported by the selected PEP
= allow

Any missing mandatory input, engine error, stale security projection, expired grant, denied subdecision, or unsupported obligation results in deny. Reason codes are stable and safe for logs; sensitive policy internals are not returned to callers.

Policy projection

The Policy Service and User Service publish versioned changes through transactional outboxes. dx-authz-go projects policy and membership relationships into OpenFGA. The planned OPA distribution path compiles reviewed policy into versioned, integrity-verified bundles. Activation status and bundle/graph versions are observable. Periodic reconciliation repairs drift between authorities and projections.

Creation and revocation are deliberately asymmetric: a new grant denies until active; revocation and invalidation take priority over cleanup. Expiry is evaluated by the decision service's trusted clock.

Caching

Only a complete composite decision may be cached. The key includes subject, actor/delegation, organisation, action, resource, relevant context, and policy/relationship versions. Allow entries use short TTLs and explicit invalidation. Deny caching is bounded so recovery does not create a long false denial. Data-plane carried decisions are also short-lived and bound to the exact operation.

Troubleshooting order

1. Confirm token and workload identity validation.
2. Confirm authoritative resource and organisation facts.
3. Confirm the policy is active, unexpired, and covers the access mode.
4. Compare policy and membership event watermarks with OpenFGA projection versions.
5. Query the relationship result and inspect model/type/relation names.
6. Inspect the OPA bundle version and contextual reason codes when that path is enabled.
7. Confirm the PEP supports every obligation.
8. For agents, confirm delegation, lifecycle, approval, session, and kill-switch state.
9. Correlate the decision ID with gateway, service, and audit traces.

See Security Architecture, Authorization Flow, and Policy Lifecycle.