# user-engine policy service

Dynamic human subjects arrive as verified KeyCape claims, so the registry
defines the protected system while the policy evaluates tenant, roles, and
self context from each request. Platform operators may cross tenants;
tenant administrators and self-service users may not.

Validate with:

```bash
flex-auth test-policy -file examples/user-engine/policy_package.md
flex-auth load-registry -file examples/user-engine/registry_snapshot.json
```