An authorization policy is a named set of requirements that determines whether an authenticated principal may perform an operation. Unlike role checks, policy requirements must be explicitly declared and registered in Program.cs, then selected through the Authorize attribute. section 9.4.7
Policies support claims-based checks such as requiring both the Moderator role and a mobile-phone claim. More complex requirements can use an assertion, such as checking whether a date-of-birth claim establishes a minimum age. section 9.4.7
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("ModeratorWithMobilePhone", policy =>
policy
.RequireClaim(ClaimTypes.Role, RoleNames.Moderator)#1
.RequireClaim(ClaimTypes.MobilePhone)); #2
});
Register a named policy with RequireClaim, then apply it to an endpoint with the Authorize attribute; related listings demonstrate an assertion-based age policy. section 9.4.7
