liveBook · Manning

Policy scope prefilter

As explained in Authorization in Action

A policy scope prefilter is a candidate-filtering technique that applies statically known policy constraints before complete authorization evaluation.

A policy scope prefilter narrows authorization candidates before complete evaluation. For a document search, relationship traversal finds reachable resources, while static constraints such as tenant, classification, or sharing status remove candidates that could never satisfy the policy. section 13.5.3

A practical authorization search combines three stages:

  • Traverse the relationship-based access control (ReBAC) graph from the principal or resource to retrieve candidate documents or users. section 13.5.3
  • Apply a partially evaluated policy residual as an efficient database, index, or graph filter; for example, constrain matching departments, shareable documents, or viewer edges. section 13.5.3
  • Send the remaining candidates to the tenant policy decision point (PDP) for complete Cedar evaluation, optionally in a batch. section 13.5.3
# Example: docs this user can access
cands   = graph.traverse_from_principal(p, action="doc:view")
scoped  = prefilter_by_scope(cands, action="doc:view")
result  = pdp.batch_authorize(principal=p, action="doc:view",
                              resources=scoped, context=ctx)
docs    = [r for r, dec in result.items() if dec == "Permit"]

The access-search pattern shows graph traversal, scope filtering, batch authorization, and Permit-only result selection. section 13.5.3

How Authorization in Action covers it

How deep it goes
Defines residual-based filtering and conversion patterns, while deferring detailed residual mechanics to a later treatment.
Examples
Uses tenant, department, classification, shareable-document, approved-domain, and viewer-relationship filters.
What it assumes
Assumes relationship graphs, policy decision points, actions, tenants, and complete policy evaluation.
What you can do after
Apply it via graph traversal, efficient scope filters, and batch PDP confirmation for candidate resources or principals.
How it connects
Connects policy engines with ReBAC, Cedar, partial evaluation, graph traversal, database filters, and batch authorization.
Cover of Authorization in Action
liveBookmanning.com
Read Authorization in Action on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.