---
id: NK-ADR-0018
type: architecture-decision-record
title: "The access-engine Core Is the Production PDP; Topaz Is Deferred"
status: accepted
owner: net-kingdom
revision: "1"
decided: "2026-10-27"
last_reviewed: "2026-10-27"
review_interval: 12m
amends: [NK-ADR-0006]
---

# ADR-0018 - access-engine Core as Production PDP

**Status:** Accepted by Bernd Worsch on 2026-10-27, as hub decision `37464824-a939-415f-8a7a-5f81cbf498c8`
(NK-WP-0055-T10).
**Date:** 2026-10-27
**Decider:** Bernd Worsch

## Context

ADR-0006 and `docs/platform-identity-security-architecture.md` name Topaz as the first delegated policy decision point
(PDP) behind flex-auth, now access-engine. In practice Topaz exists only as an adapter shape (FLEX-WP-0004), and nothing
deploys it. Every live decision comes from the access-engine Go core.

The core already provides:

- tenant scope;
- relationship facts and inherited access;
- check, list-allowed and explain;
- caller authentication.

The core was shaped to Topaz's policy-plus-directory model from the start. The production readiness ledger (NK-WP-0055-T01)
lists the Topaz runtime as an open area.

## Decision

- The access-engine Go core is the production PDP. A delegated Topaz runtime is not required for production readiness, and
  that readiness area is an accepted exception.
- The PDP readiness checks still apply, but they are now run against the core:
  - health;
  - data freshness;
  - policy load status;
  - fail-closed behaviour, verified per consumer through each consumer's `pep-stance.yaml`.
- The policy import gap that Topaz bundles would have closed moves to NK-WP-0055-T14. Either policies load without an image
  rebuild, or rebuild-and-deploy is accepted as the import path.
- Topaz is no longer an expected audit source (NK-WP-0055-T11).
- Topaz is deferred, not rejected. ADR-0006's rule still holds for any future delegated PDP: it evaluates policy, and it
  never becomes the canonical policy model, the identity provider or the control plane.

## Revisit when

- a tenant needs per-object sharing, or relationship data outgrows the core's relationship facts;
- the number of tenants or the depth of group nesting makes core evaluation a bottleneck;
- policy changes become too frequent for the T14 import path;
- the production declaration (NK-WP-0055-T09) reviews its accepted exceptions.

## Consequences

- There is one less runtime to operate, back up, audit and drill.
- Authorization availability is coupled to access-engine. HA is out of scope by the same decision.
- Reversibility is high: adding Topaz later extends the system rather than rebuilding it.
- Where `docs/platform-identity-security-architecture.md` describes Topaz as the first delegated PDP, read it with this
  amendment.