The Cedar is_authorized API evaluates an authorization request and returns an allow or deny decision. A policy enforcement point (PEP) assembles the request from the active identity, attempted action, target resource, context attributes, and relevant entity data. section 9.8
A PEP prepares each evaluation by:
- Identifying the principal from a session or token. section 9.8
- Selecting the action and resolving the target resource. section 9.8
- Adding context such as device management status or time. section 9.8
- Checking that attributes and entity references are complete, consistent with the Cedar schema, and correctly scoped. section 9.8
Document sharing request
A request to share a document can identify an employee as principal, use doc:share as the action, identify the document as resource, and include managed-device and time context. The PEP forwards the operation only when the API returns allow. section 9.8
Figure 9.2 The Policy Enforcement Point (PEP) in ACME’s Customer Collaboration platform translates a real-world /share request into a Cedar evaluation by combining session data (principal), entity data (resource relationships), and context signals (environment attributes). Cedar’s is_authorized API provides an allow or deny decision, which the PEP enforces before forwarding the request to the backend.
Trace how a real-world /share request becomes a Cedar evaluation combining session identity, resource relationships, and environmental signals. section 9.8
