Skip to content

Authorization Decisions and Output Handling Cheat Sheet / 授权决策与输出处理速查表

Introduction / 介绍

A Policy Decision Point (PDP) evaluates access; a Policy Enforcement Point (PEP) applies the result before releasing data or performing an action. OpenID AuthZEN Authorization API 1.0 defines single and multiple evaluations, as well as search interfaces. This sheet covers enforcing individual decisions, authorized resource lists, and query filters. See Authorization Patterns for placement and Policy and Data Distribution for trustworthy inputs.

策略决策点（PDP）评估访问；策略执行点（PEP）在释放数据或执行操作前应用结果。OpenID AuthZEN 授权 API 1.0 定义了单次和多次评估，以及搜索接口。本表涵盖了执行单个决策、授权资源列表和查询过滤器。有关放置位置，请参阅授权模式，有关可信输入，请参阅策略和数据分发。

Single and Batch Decisions / 单次和批量决策

Bind each decision to the authenticated subject, action, resource, tenant, and relevant context. AuthZEN's evaluation interfaces carry the information used to evaluate access. Supplying verified role or relationship attributes is legitimate when the policy requires them; accepting a client's assertion of its own privileges is not.

将每个决策绑定到已认证的主体、操作、资源、租户和相关信息。AuthZEN的评估接口https://openid.net/specs/authorization-api-1_0.html#section-6携带用于评估访问的信息。当策略需要时，提供已验证的角色或关系属性是合法的；接受客户端对其自身特权的声明则不合法。

A batch groups separate access checks. Match each response to its corresponding request using the ordering or identifiers defined by the API, and deny an item whose result is missing, invalid, or an error. Do not apply one item's permit to the entire batch. UI checks can determine which buttons to display, but the operation itself still requires server-side authorization.

批量组分组独立的访问检查。使用API定义的顺序或标识符将每个响应与其对应的请求匹配，如果结果缺失、无效或错误，则拒绝该项。不要将单个项目的许可应用于整个批次。UI检查可以确定要显示哪些按钮，但操作本身仍然需要服务器端授权。

Enforcing Access to Collections / 强制访问集合

Choose by the PDP's documented output semantics and the data store's supported integration, not by labels such as relationship-based access control (ReBAC). OpenFGA's ListObjects documentation and Cerbos's query-plan API illustrate different contracts.

根据PDP的文档化输出语义和数据存储支持的集成选择，而不是根据标签，如基于关系的访问控制（ReBAC）。OpenFGA的ListObjects文档和Cerbos的查询计划API说明了不同的合约。

Check Each Candidate / 检查每个候选者

The PEP retrieves a bounded candidate set and evaluates each item, individually or in a batch.

PEP检索一个有界候选集并评估每个项目，可以是单个或批量评估。

PDP as a filter

PDP 作为过滤器

Use this for small sets when a list or filter interface is unavailable. Keep candidate data inside the trusted service until checks complete; exclude denied and unresolved items. Apply the same restriction to counts, exports, and other outputs that could reveal protected data.

当没有列表或过滤器接口时，适用于小型集合。在检查完成之前，将候选数据保留在受信任的服务中；排除被拒绝和未解决的项目。对计数、导出和其他可能泄露受保护数据的输出应用相同的限制。

Retrieve Authorized Resource Identifiers / 检索授权资源标识符

The PDP returns identifiers that the subject may access for a particular action. The application restricts its data retrieval to those identifiers and its own tenant and business predicates.

PDP返回主题可以访问的特定操作的标识符。应用程序将其数据检索限制在这些标识符及其自己的租户和业务谓词上。

Authorized data set

授权数据集

Treat the result as complete only when the API guarantees completion. OpenFGA documents deadline and result-count limits for ListObjects; do not assume every implementation provides a pagination cursor or unlimited streaming. A truncated authorized subset can be displayed as partial when the API guarantees each returned item is permitted, but cannot establish the complete authorized set. Never interpret an empty or incomplete list as permission to remove the restriction. Recheck authorization for subsequent operations or when the relevant state changes.

只有当API保证完成时，才将结果视为完整。OpenFGA文档了ListObjects的截止日期和结果计数限制；不要假设每个实现都提供分页游标或无限流。当API保证每个返回的项目都是允许的，可以显示为部分授权的截断授权子集，但不能建立完整的授权集。永远不要将空或不完整的列表解释为移除限制的许可。在后续操作或相关状态变化时重新检查授权。

Apply an Authorization Filter / 应用授权过滤器

The PDP returns a predicate or query plan that the data layer enforces while retrieving resources.

PDP返回一个数据层在检索资源时强制执行的谓词或查询计划。

Authorization filter

授权过滤器

Use a maintained adapter for the exact PDP and data store. Cerbos PlanResources distinguishes always-allowed, always-denied, and conditional plans; OPA's Compile API supports partial evaluation. Capabilities depend on the implementation and policy language, not a universal restriction on ReBAC or other model families.

使用维护的适配器以精确匹配PDP和数据存储。Cerbos PlanResources区分始终允许、始终拒绝和条件计划；OPA的编译API支持部分评估。能力取决于实现和政策语言，而不是ReBAC或其他模型家族的通用限制。

Security Considerations / 安全考量

An output is useful only if the PEP enforces its full meaning. AuthZEN's response-integrity and trust requirements apply to the channel and components carrying decisions.

  • Cover every data path. Enforce the restriction on list, search, export, count, aggregate, and direct-object reads. An authorized list does not authorize a later update or delete.
  • Intersect predicates. Combine authorization restrictions with application and tenant predicates using logical AND. An always-allowed authorization result does not remove those other restrictions; always-denied must return no protected data.
  • Preserve query semantics. Reject unsupported operators or incomplete translations. Check adapter behavior for nulls, missing attributes, joins, and collection membership against the policy's meaning. Do not silently omit an expression that cannot be translated.
  • Keep values separate from syntax. Bind filter values as parameters and allow-list structural choices such as field names and operators. Do not execute a returned debug string as a query. See SQL Injection Prevention.
  • Fail closed. Deny protected operations on PDP errors, timeouts, or unusable output. Apply Deny by Default, including when a filter is absent; a missing filter is not an unrestricted result.
  • Bound reuse. Cache only for the same subject, action, resource scope, tenant, and relevant policy/input state, within the approved freshness limit. Account for changes between evaluation and use; a cached permit must not outlive a required revocation deadline.
    中文：边界重用。 仅缓存相同主体、操作、资源范围、租户和相关策略/输入状态，在批准的新鲜度限制内。考虑评估和使用之间的变化；缓存许可不得超过所需的撤销截止日期。

Verify integrations with permitted and denied resources, tenant boundaries, each explicit filter result kind, incomplete batches or lists, and PDP failure. Compare a filter's selected resources with individual decisions for representative policy cases. These checks validate the adapter and enforcement paths, not just successful communication with the PDP.

Batching and filtering can reduce work, but do not trade away enforcement or freshness to meet a latency target. Prefer a documented query-filter integration for large queryable collections; use bounded per-item checks when that integration is unavailable or cannot preserve the policy's meaning.

References / 参考