An assertion is a declarative statement that evaluates as true or false for given data. In policy-as-code, it describes a fixed structure: data that looks a certain way is approved. Assertions are expressed as predicates—properties or descriptions of subjects—and can include variables whose values determine whether the statement holds. section 4.2.1
Use the surrounding vocabulary to make an assertion operational:
- Treat the predicate as the condition, such as “X is writing a book.” section 4.2.1
- Treat the extension as every subject in the data domain that satisfies the predicate. section 4.2.1
- Evaluate each subject variable against available data to obtain a true or false result. section 4.2.1
Policy approval
A Rego rule can assert that a user is allowed when the user's age exceeds 12. For a supplied input, the policy returns an allow result alongside the evaluated assertion. section 4.2.1
package test #1
default allow := false #2
allow if user_is_over_12 #3
user_is_over_12 if { #4
data.user_attributes[input.user].age > 12
}
Inspect a compact Rego policy that defines a default decision, an approval assertion, and the predicate supporting it. section 4.2.1
