Write access policies

Access policies decide which subjects can read which objects, with optional row filters and column projection — enforced server-side in the cell, fail-closed.

Drafting

A complete policy-authoring walkthrough is coming. This page outlines the model; see Governance & the cell for the concepts and Authentication for the roles that policies match on.

The model in one paragraph

OSL emits policy facts for every governed object. The policy decision point matches a request’s (data, action, actor, context) against those facts and the policies you author, returning allow/deny plus obligations (row filters, projection, redaction). The policy enforcement point applies the decision before any data leaves the cell.

Effective policy snapshot

To see the decisions that currently apply to a tenant:

GET /v1/tenants/{t}/policies/effective

Principles that won’t change

• Fail-closed. No snapshot → deny (E2001, 503). Deny-by-default on ACL’d facets.
• PII is declared at the connector, never inferred in the UI, and redacted server-side.
• Non-revealing denials. A denied request never discloses which policy denied.
• Everything is audited — allow or deny — on one hash-chained trail.