Access Policy Linter

Overview

You send an access-policy document — rules of subjects, actions, resources, optional conditions, and the algorithm that combines them — and we report where it contradicts itself. Ten findings, each with a fixed severity: opposite effects on a shared tuple, a rule an earlier rule makes unreachable, overlapping conditions, rules that can never fire, wildcards broader than the profile you declared, and references to subjects, actions or resources your dictionary does not define. Findings carry rule identifiers and field paths and never the subject, action, resource or condition value that triggered them, because a lint report gets pasted into tickets. We answer nothing about any single request: no decision comes out of here, and a clean lint predicts nothing about what an evaluator will allow.

An evaluator tells you what happens to one request; it cannot tell you that rule 7 is unreachable because rule 3 already covers it. Shadowing, contradiction and over-broad wildcards are properties of the whole rule set under a precedence order, and you want them before the policy ships, not after an audit finds them.

When to use it

Scope

Non-goals

• Does not decide whether any request is permitted — that is identity.evaluate_abac and identity.evaluate_rbac, and nothing here is an authorization answer
• Does not store, version, publish or distribute your policy
• Does not accept a subject, an environment or any request context
• Does not accept the role-grant table shape that identity.evaluate_rbac takes
• Does not quote a subject, action, resource or condition value back to you
• Does not certify compliance with any regulation or framework

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"governance.policy_lint","input":{"policy":{"rules":[{"id":"allow-finance-read","effect":"ALLOW","subjects":["group:finance"],"actions":["read"],"resources":["ledger:2026"]}]},"options":{"profile":"STRICT_NO_WILDCARD"}}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("governance.policy_lint", {"policy":{"rules":[{"id":"allow-finance-read","effect":"ALLOW","subjects":["group:finance"],"actions":["read"],"resources":["ledger:2026"]},{"id":"deny-finance-read","effect":"DENY","subjects":["group:finance"],"actions":["read"],"resources":["ledger:2026"]}],"defaultDecision":"DENY","combiningAlgorithm":"DENY_OVERRIDES"},"options":{"profile":"STRICT_NO_WILDCARD"}});

Errors

Other limits

Limitations

• Does not decide whether any request is permitted — that is identity.evaluate_abac and identity.evaluate_rbac, and nothing here is an authorization answer
• Does not store, version, publish or distribute your policy
• Does not accept a subject, an environment or any request context
• Does not accept the role-grant table shape that identity.evaluate_rbac takes
• Does not quote a subject, action, resource or condition value back to you
• Does not certify compliance with any regulation or framework
• Deciding a live request — send that to an evaluator
• Linting a role-to-permission grant table, which is a different document shape
• Looking for a guarantee that a clean document will allow what you expect

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "governance.policy_lint",
  "input": {
    "policy": {
      "rules": [
        {
          "id": "allow-finance-read",
          "effect": "ALLOW",
          "subjects": [
            "group:finance"
          ],
          "actions": [
            "read"
          ],
          "resources": [
            "ledger:2026"
          ]
        },
        {
          "id": "deny-finance-read",
          "effect": "DENY",
          "subjects": [
            "group:finance"
          ],
          "actions": [
            "read"
          ],
          "resources": [
            "ledger:2026"
          ]
        }
      ],
      "defaultDecision": "DENY",
      "combiningAlgorithm": "DENY_OVERRIDES"
    },
    "options": {
      "profile": "STRICT_NO_WILDCARD"
    }
  }
}

Examples

{
  "policy": {
    "rules": [
      {
        "id": "allow-finance-read",
        "effect": "ALLOW",
        "subjects": [
          "group:finance"
        ],
        "actions": [
          "read"
        ],
        "resources": [
          "ledger:2026"
        ]
      },
      {
        "id": "deny-finance-read",
        "effect": "DENY",
        "subjects": [
          "group:finance"
        ],
        "actions": [
          "read"
        ],
        "resources": [
          "ledger:2026"
        ]
      }
    ],
    "defaultDecision": "DENY",
    "combiningAlgorithm": "DENY_OVERRIDES"
  },
  "options": {
    "profile": "STRICT_NO_WILDCARD"
  }
}

{
  "issues": [
    {
      "code": "POLICY_EFFECT_CONFLICT",
      "severity": "ERROR",
      "ruleId": "deny-finance-read",
      "relatedRuleId": "allow-finance-read",
      "fieldPath": "policy.rules[1].effect",
      "overlapKind": "EXACT"
    }
  ],
  "summary": {
    "ruleCount": 2,
    "tupleTotal": 2,
    "tuplePairsCompared": 1,
    "issueCount": 1,
    "errorCount": 1,
    "warningCount": 0,
    "infoCount": 0,
    "suppressedBelowFloor": 0,
    "undecidedConditionPairs": 0,
    "combiningAlgorithm": "DENY_OVERRIDES",
    "profile": "STRICT_NO_WILDCARD",
    "catalogueVersion": "gov-lint-1",
    "truncated": false
  }
}

{
  "policy": {
    "rules": [
      {
        "id": "allow-any-read",
        "effect": "ALLOW",
        "subjects": [
          "*"
        ],
        "actions": [
          "read"
        ],
        "resources": [
          "ledger:2026"
        ]
      },
      {
        "id": "allow-audit-read",
        "effect": "ALLOW",
        "subjects": [
          "group:audit"
        ],
        "actions": [
          "read"
        ],
        "resources": [
          "ledger:2026"
        ]
      }
    ],
    "combiningAlgorithm": "FIRST_APPLICABLE"
  },
  "options": {
    "profile": "WILDCARD_ALLOWED",
    "maxIssues": 50,
    "severityFloor": "INFO"
  }
}

{
  "issues": [
    {
      "code": "POLICY_RULE_SHADOWED",
      "severity": "WARNING",
      "ruleId": "allow-audit-read",
      "relatedRuleId": "allow-any-read",
      "fieldPath": "policy.rules[1]",
      "overlapKind": "SUBJECT_WILDCARD"
    }
  ],
  "summary": {
    "ruleCount": 2,
    "tupleTotal": 2,
    "tuplePairsCompared": 1,
    "issueCount": 1,
    "errorCount": 0,
    "warningCount": 1,
    "infoCount": 0,
    "suppressedBelowFloor": 0,
    "undecidedConditionPairs": 0,
    "combiningAlgorithm": "FIRST_APPLICABLE",
    "profile": "WILDCARD_ALLOWED",
    "catalogueVersion": "gov-lint-1",
    "truncated": false
  }
}

Recommended use cases

• Review a rule set before it ships, and catch a rule an earlier one already covers
• Prove a policy carries no allow/deny contradiction on the same subject, action and resource
• Hold a policy to a wildcard profile in review, so a broad grant is a finding rather than a habit

Avoid for

• Deciding a live request — send that to an evaluator
• Linting a role-to-permission grant table, which is a different document shape
• Looking for a guarantee that a clean document will allow what you expect

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags