Arsenal policy

arsenal-core::policy defines PolicyDocument, PolicyRule, PolicyCondition, ConditionOperator, PolicyRequest, and PolicyDecision. arsenal-policy::PolicyEngine stores documents and evaluates them against a request.

Configure and evaluate

Create a tenant-scoped policy document, add rules with explicit effects and required conditions/scopes, and install it in the engine. Construct PolicyRequest from verified application context, not arbitrary client-provided tenant claims. The engine evaluates policies in descending priority and returns the first decision with a matched rule; no match produces a denial.

A policy decision alone does not execute or block a request. The broker/application must branch on it before issuing credentials or proxying an upstream action.

Serialization and limits

PolicyDocument exposes to_cbor and from_cbor. Use the actual enum and typed condition fields; do not invent a parallel YAML/JSON grammar based on a policy name. Validate depth, size and supported operators using the current source implementation.

Read exact condition variants and document fields and the engine API. Test no match, conflicting priorities, wrong tenant, missing context and explicit denial.