Author Policies with the SDK

Define deterministic executable Policy decisions and use canonical identity, action, Resource, and constraint contracts.

Use policy() when authorization logic cannot be expressed with declarative Policy rules. Bind every decision to the supplied input hash.

Executable Policy

import { hashValue, policy } from "@constal/sdk";

export default policy({
  id: "ticket-read", version: "1.0.0",
  async evaluate(request) {
    const allowed = request.input.action === "resource:invoke"
      && request.input.context?.["resource.operation"] === "ticket.read";
    const decision = allowed
      ? { kind: "allow" as const, explicitDeny: false, constraints: [] }
      : { kind: "deny" as const, explicitDeny: true, constraints: [], reason: "operation denied" };
    return { inputHash: request.inputHash, outputHash: await hashValue(decision), decision };
  },
});

The evaluator has no network, secret, storage, or clock capability. It receives normalized identity, exact action and Resource, bounded context, optional invocation data, and the deployed Policy snapshot. Return allow, deny, require-approval, substitute, constrain, or grant with a deterministic output hash. Explicit deny wins; scopes only narrow existing authority.

Package the definition with constal.policy.json, test positive and negative inputs, and inspect the Policy hash pinned by an accepted Run. Continue with Author a Policy and CLI Policy evaluation.