var G=Object.defineProperty;var H=(A)=>A;function I(A,B){this[A]=H.bind(null,B)}var K=(A,B)=>{for(var E in B)G(A,E,{get:B[E],enumerable:!0,configurable:!0,set:I.bind(B,E)})};var M=(A,B)=>()=>(A&&(B=A(A=0)),B);import F from"@contractspec/lib.ui-link";import{ChevronRight as J}from"lucide-react";import{jsx as q,jsxs as z}from"react/jsx-runtime";function T(){return z("div",{className:"space-y-8",children:[z("div",{className:"space-y-4",children:[q("h1",{className:"font-bold text-4xl",children:"Policy Decision Points"}),z("p",{className:"text-muted-foreground",children:["A ",q("strong",{children:"Policy Decision Point (PDP)"})," is a centralized component that evaluates access control policies and makes authorization decisions. According to"," ",q("a",{href:"https://www.strongdm.com/blog/policy-decision-point",target:"_blank",rel:"noopener noreferrer",className:"text-violet-400 hover:text-violet-300",children:"StrongDM"}),', the PDP "receives requests for access to resources, evaluates them against policies, and returns a decision (permit or deny)."']})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"How the PDP works in ContractSpec"}),q("p",{className:"text-muted-foreground",children:"In ContractSpec, the PDP is invoked on every operation—whether it's rendering a UI component, executing a capability, or querying a data view. The flow is:"}),z("ol",{className:"list-inside list-decimal space-y-3 text-muted-foreground",children:[z("li",{children:[q("strong",{children:"Request evaluation"})," – The runtime sends a request to the PDP containing:",z("ul",{className:"mt-2 ml-6 list-inside list-disc space-y-1",children:[q("li",{children:"The user's identity and attributes (roles, groups, location, etc.)"}),q("li",{children:"The resource being accessed (capability, field, workflow step)"}),q("li",{children:"The action being performed (read, write, execute)"}),q("li",{children:"Contextual information (time of day, device type, IP address)"})]})]}),z("li",{children:[q("strong",{children:"Policy evaluation"})," – The PDP evaluates the request against all applicable ",q("strong",{children:"PolicySpecs"}),". These specs define rules using attribute-based access control (ABAC) and can reference:",z("ul",{className:"mt-2 ml-6 list-inside list-disc space-y-1",children:[q("li",{children:`User attributes (e.g., "role == 'admin'")`}),q("li",{children:`Resource attributes (e.g., "field.sensitivity == 'PII'")`}),q("li",{children:'Environmental attributes (e.g., "time.hour >= 9 AND time.hour < 17")'})]})]}),z("li",{children:[q("strong",{children:"Decision return"})," – The PDP returns one of:",z("ul",{className:"mt-2 ml-6 list-inside list-disc space-y-1",children:[z("li",{children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"PERMIT"})," ","– The operation is allowed."]}),z("li",{children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"DENY"})," ","– The operation is blocked."]}),z("li",{children:[q("code",{className:"rounded bg-background/50 px-2 py-1",children:"REDACT"})," ","– The operation is allowed, but sensitive fields are masked."]})]})]}),z("li",{children:[q("strong",{children:"Enforcement"})," – The runtime enforces the decision. If denied, the operation fails with a clear error message. If redacted, sensitive fields are replaced with placeholders."]}),z("li",{children:[q("strong",{children:"Auditing"})," – Every PDP decision is logged to the"," ",q(F,{href:"/docs/safety/auditing",className:"text-violet-400 hover:text-violet-300",children:"audit log"}),", including the request, decision, and reasoning."]})]})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Example PolicySpec"}),q("p",{className:"text-muted-foreground",children:"Here's a simple policy that restricts access to PII fields:"}),q("div",{className:"overflow-x-auto rounded-lg border border-border bg-background/50 p-4 font-mono text-muted-foreground text-sm",children:q("pre",{children:`policyId: pii-access-control
version: '1.0.0'.0.0
rules:
  - id: allow-admin-full-access
    effect: PERMIT
    condition: user.role == 'admin'
    
  - id: redact-pii-for-support
    effect: REDACT
    condition: |
      user.role == 'support' AND
      field.sensitivity == 'PII'
    redactFields: ['ssn', 'creditCard', 'dateOfBirth']
    
  - id: deny-pii-for-others
    effect: DENY
    condition: |
      user.role NOT IN ['admin', 'support'] AND
      field.sensitivity == 'PII'`})}),q("p",{className:"text-muted-foreground",children:"With this policy, admins see all data, support staff see redacted PII, and other users cannot access PII at all."})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Benefits of centralized decision-making"}),z("ul",{className:"list-inside list-disc space-y-2 text-muted-foreground",children:[z("li",{children:[q("strong",{children:"Consistency"})," – Policies are enforced uniformly across all surfaces (API, UI, workflows)."]}),z("li",{children:[q("strong",{children:"Auditability"})," – Every decision is logged, making it easy to trace why access was granted or denied."]}),z("li",{children:[q("strong",{children:"Flexibility"})," – Policies can be updated without changing application code."]}),z("li",{children:[q("strong",{children:"Security"})," – Reduces the risk of authorization bugs by removing ad-hoc checks scattered throughout the codebase."]})]})]}),z("div",{className:"space-y-4",children:[q("h2",{className:"font-bold text-2xl",children:"Performance considerations"}),q("p",{className:"text-muted-foreground",children:"Because the PDP is invoked on every operation, performance is critical. ContractSpec optimizes this by:"}),z("ul",{className:"list-inside list-disc space-y-2 text-muted-foreground",children:[q("li",{children:"Caching policy decisions for identical requests"}),q("li",{children:"Compiling policies into efficient bytecode"}),q("li",{children:"Evaluating only the minimal set of rules needed for each request"}),q("li",{children:"Running the PDP in-process to avoid network latency"})]}),q("p",{className:"text-muted-foreground",children:"In practice, PDP overhead is typically less than 1ms per request."})]}),z("div",{className:"flex items-center gap-4 pt-4",children:[q(F,{href:"/docs/safety/signing",className:"btn-ghost",children:"Previous: Spec Signing"}),z(F,{href:"/docs/safety/auditing",className:"btn-primary",children:["Next: Audit Logs ",q(J,{size:16})]})]})]})}export{T as SafetyPDPPage};
