access-engine/registry/capabilities/capability.authorization.policy-evaluate.md

id	name	summary	owner	status	domain	tags	maturity	external_evidence	discovery	availability	relations	consumer_guidance	promotion_history	evidence
capability.authorization.policy-evaluate	Policy evaluation and decision evidence	Check, batch, list-allowed, explain, binding, lifetime and decision records.	access-engine	draft	helix_forge	authorization policy flex-auth security netkingdom framework-reuse	discovery availability current target confidence rationale D4 D6 medium flex-auth INTENT defines policy-as-code boundary and enterprise growth path. current target confidence rationale A4 A5 low Source interface assessed 2026-10-14: Check, batch, list-allowed, explain, binding, lifetime and decision records. Availability describes the delivery form, not production acceptance. One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct.	completeness reliability level name confidence basis satisfied_expectations broken_expectations out_of_scope_expectations C2 Partial low scope_vs_intent_and_consumer_expectations policy-as-code intent documented not yet indexed from flex-auth native registry identity proofing level confidence basis known_reliability_risks R1 low consumer_quality_signals early implementation phase	intent includes excludes use_cases Check, batch, list-allowed, explain, binding, lifetime and decision records Check, batch, list-allowed, explain, binding, lifetime and decision records One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct U03: Application combines identity, tenant and resource facts and enforces a bound decision U04: Protected operation obtains and consumes exact human approval before its side effect U05: Operator provisions and delivers a scoped workload credential through the approved owner lane U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity	current_level target_level current_artifacts consumption_modes A4 A5 SCOPE.md README.md HTTP API source	depends_on related_to capability.identity.subject-resolution capability.feature-control.evaluate capability.security.approval-lifecycle capability.iam.key-cape capability.identity.tenant-facts capability.security.zone-reference capability.security.maturity-claims	recommended_for not_recommended_for known_limitations Application combines identity, tenant and resource facts and enforces a bound decision Protected operation obtains and consumes exact human approval before its side effect Operator provisions and delivers a scoped workload credential through the approved owner lane Operator or automation obtains a bounded SSH certificate and maintains private connectivity One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.	date dimension from to rationale author 2026-10-14 availability A2 A4 Interface-form reassessment from current owner sources; no completeness/reliability promotion. codex	documentation SCOPE.md README.md

Policy evaluation and decision evidence

Check, batch, list-allowed, explain, binding, lifetime and decision records.

Reuse boundary

One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct.

Supported use cases

• U03: Application combines identity, tenant and resource facts and enforces a bound decision
• U04: Protected operation obtains and consumes exact human approval before its side effect
• U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
• U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity

Evidence and integration

• SCOPE.md
• README.md

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.