Agent Action Authorization Check

Overview

You send subject attributes, an action, resource attributes, optional context and up to 1,000 statements with effect ALLOW or DENY, actions, resources and conditions. Operators are EQUALS, IN, MATCHES_GLOB and numeric or time comparisons. Combining is DENY_OVERRIDES. Missing attributes and type mismatches mean that statement does not match. The explanation never echoes unrelated policy values. This does not enforce the decision or look up a directory.

An agent that proposes a tool call needs a typed allow/deny answer without a live directory.

When to use it

Scope

Non-goals

• Does not enforce the decision
• Does not look up a directory
• Does not execute arbitrary policy languages

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"agent.action_authorization_check","input":{"subject":{},"action":"read","resource":{"id":"x"},"statements":[{"id":"s1","effect":"ALLOW","actions":["read"],"resources":["x"]}]}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("agent.action_authorization_check", {"subject":{"role":"analyst"},"statements":[{"actions":["files.read"],"resources":["doc-1"],"effect":"ALLOW","id":"allow-read"},{"actions":["files.*"],"resources":["doc-*"],"effect":"DENY","id":"deny-read"}],"action":"files.read","resource":{"id":"doc-1"}});

Errors

Other limits

Limitations

• Does not enforce the decision
• Does not look up a directory
• Does not execute arbitrary policy languages
• Enforcing the decision at a gateway
• Expanding roles from a directory

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "agent.action_authorization_check",
  "input": {
    "subject": {
      "role": "analyst"
    },
    "statements": [
      {
        "actions": [
          "files.read"
        ],
        "resources": [
          "doc-1"
        ],
        "effect": "ALLOW",
        "id": "allow-read"
      },
      {
        "actions": [
          "files.*"
        ],
        "resources": [
          "doc-*"
        ],
        "effect": "DENY",
        "id": "deny-read"
      }
    ],
    "action": "files.read",
    "resource": {
      "id": "doc-1"
    }
  }
}

Examples

{
  "subject": {
    "role": "analyst"
  },
  "statements": [
    {
      "actions": [
        "files.read"
      ],
      "resources": [
        "doc-1"
      ],
      "effect": "ALLOW",
      "id": "allow-read"
    },
    {
      "actions": [
        "files.*"
      ],
      "resources": [
        "doc-*"
      ],
      "effect": "DENY",
      "id": "deny-read"
    }
  ],
  "action": "files.read",
  "resource": {
    "id": "doc-1"
  }
}

{
  "decision": "DENY",
  "combining": "DENY_OVERRIDES",
  "matchedStatementIds": [
    "deny-read",
    "allow-read"
  ],
  "explanation": "DENY_OVERRIDES: a matching DENY statement won."
}

{
  "subject": {
    "role": "guest"
  },
  "statements": [
    {
      "actions": [
        "files.read"
      ],
      "resources": [
        "doc-1"
      ],
      "effect": "ALLOW",
      "id": "allow-read"
    }
  ],
  "action": "files.delete",
  "resource": {
    "id": "doc-1"
  }
}

{
  "decision": "NOT_APPLICABLE",
  "combining": "DENY_OVERRIDES",
  "matchedStatementIds": [],
  "explanation": "DENY_OVERRIDES: no statement matched the proposed action."
}

Recommended use cases

• Let an explicit DENY beat a matching ALLOW
• Treat a missing subject attribute as a non-match rather than an allow

Avoid for

• Enforcing the decision at a gateway
• Expanding roles from a directory

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags