A determining policy is a satisfied policy that directly influences an authorization decision. It matched the request and helped cause the system to return allow or deny. section 4.3.2
Distinguish determining policies from the broader set of satisfied policies:
- Satisfied policies match the authorization request and may influence evaluation. section 4.3.2
- Determining policies are the subset that decisively produces the authorization result. section 4.3.2
Figure 4.1 Relationships among key authorization terms. Principals, actions, and resources form the core of access decisions and are enriched with attributes, roles, and group memberships. All entities exist within namespaces and can be either principals or resources. The diagram also shows the legacy term subject as an older equivalent of principal and illustrates how actions operate on resources based on contextual and identity-based properties.
Maps the principals, actions, resources, attributes, roles, groups, namespaces, and context that surround an authorization request. section 4.3.2
