access-engine/registry/capabilities/capability.authorization.policy-evaluate.md

---
id: capability.authorization.policy-evaluate
name: Policy evaluation and decision evidence
summary: Check, batch, list-allowed, explain, binding, lifetime and decision records.
owner: access-engine
status: draft
domain: helix_forge
tags:
- authorization
- policy
- flex-auth
- security
- netkingdom
- framework-reuse
maturity:
  discovery:
    current: D4
    target: D6
    confidence: medium
    rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth
      path.
  availability:
    current: A4
    target: A5
    confidence: low
    rationale: 'Source interface assessed 2026-10-14: Check, batch, list-allowed,
      explain, binding, lifetime and decision records. Availability describes the
      delivery form, not production acceptance. One PDP owner with per-consumer deployments;
      signed envelope production and consumer adoption are distinct.'
external_evidence:
  completeness:
    level: C2
    name: Partial
    confidence: low
    basis: scope_vs_intent_and_consumer_expectations
    satisfied_expectations:
    - policy-as-code intent documented
    broken_expectations:
    - not yet indexed from flex-auth native registry
    out_of_scope_expectations:
    - identity proofing
  reliability:
    level: R1
    confidence: low
    basis: consumer_quality_signals
    known_reliability_risks:
    - early implementation phase
discovery:
  intent: Check, batch, list-allowed, explain, binding, lifetime and decision records
  includes:
  - Check, batch, list-allowed, explain, binding, lifetime and decision records
  excludes:
  - One PDP owner with per-consumer deployments; signed envelope production and consumer
    adoption are distinct
  use_cases:
  - 'U03: Application combines identity, tenant and resource facts and enforces a
    bound decision'
  - 'U04: Protected operation obtains and consumes exact human approval before its
    side effect'
  - 'U05: Operator provisions and delivers a scoped workload credential through the
    approved owner lane'
  - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
    connectivity'
availability:
  current_level: A4
  target_level: A5
  current_artifacts:
  - SCOPE.md
  - README.md
  consumption_modes:
  - HTTP API
  - source
relations:
  depends_on:
  - capability.identity.subject-resolution
  related_to:
  - capability.feature-control.evaluate
  - capability.security.approval-lifecycle
  - capability.iam.key-cape
  - capability.identity.tenant-facts
  - capability.security.zone-reference
  - capability.security.maturity-claims
consumer_guidance:
  recommended_for:
  - Application combines identity, tenant and resource facts and enforces a bound
    decision
  - Protected operation obtains and consumes exact human approval before its side
    effect
  - Operator provisions and delivers a scoped workload credential through the approved
    owner lane
  - Operator or automation obtains a bounded SSH certificate and maintains private
    connectivity
  not_recommended_for:
  - One PDP owner with per-consumer deployments; signed envelope production and consumer
    adoption are distinct
  known_limitations:
  - One PDP owner with per-consumer deployments; signed envelope production and consumer
    adoption are distinct
  - 2026-10-14 architecture review estimates operational maturity separately; a registry
    entry does not authorize execution or establish deployment.
promotion_history:
- date: '2026-10-14'
  dimension: availability
  from: A2
  to: A4
  rationale: Interface-form reassessment from current owner sources; no completeness/reliability
    promotion.
  author: codex
evidence:
  documentation:
  - SCOPE.md
  - README.md
---

# Policy evaluation and decision evidence

Check, batch, list-allowed, explain, binding, lifetime and decision records.

## Reuse boundary

One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct.

## Supported use cases

- U03: Application combines identity, tenant and resource facts and enforces a bound decision
- U04: Protected operation obtains and consumes exact human approval before its side effect
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity

## Evidence and integration

- [SCOPE.md](../../SCOPE.md)
- [README.md](../../README.md)

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.