Evaluate ABAC

Overview

You pass subject, action, resource, environment, and a constrained attribute-based access policy; we evaluate it deterministically and return allow or deny, matched rule ids, and a per-rule trace. Expressions use eq/neq/in/contains/comparisons with and/or/not — no code execution or reflection. We fail closed: unknown operators, excessive depth, or missing attributes deny. Do not use this as a full XACML/Rego engine or for storing policies.

An attribute policy that lives inside your application code is impossible to audit and easy to get subtly wrong. Here the grammar is small enough to read, the evaluation is the same every time, and you get back the rule-by-rule trace that explains the verdict.

When to use it

Scope

Non-goals

• No arbitrary code execution or reflection
• No dynamic traversal outside the objects you provide
• No obligations or advice beyond allow/deny
• Not a full XACML, Rego, or CEL engine

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"identity.evaluate_abac","input":{"subject":{"id":"u1"},"action":"read","resource":{"ownerId":"u1"},"environment":{},"policy":{"rules":[{"id":"own","effect":"allow","condition":{"op":"eq","attribute":"resource.ownerId","value":"u1"}}]}}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("identity.evaluate_abac", {"resource":{"ownerId":"u1"},"policy":{"rules":[{"effect":"allow","id":"own","condition":{"attribute":"resource.ownerId","op":"eq","value":"u1"}}]},"subject":{"id":"u1"},"action":"read","environment":{}});

Errors

Other limits

Limitations

• No arbitrary code execution or reflection
• No dynamic traversal outside the objects you provide
• No obligations or advice beyond allow/deny
• Not a full XACML, Rego, or CEL engine
• Simple role-only checks (use identity.evaluate_rbac)
• Storing or versioning policies
• Executing unrestricted expression languages

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "identity.evaluate_abac",
  "input": {
    "resource": {
      "ownerId": "u1"
    },
    "policy": {
      "rules": [
        {
          "effect": "allow",
          "id": "own",
          "condition": {
            "attribute": "resource.ownerId",
            "op": "eq",
            "value": "u1"
          }
        }
      ]
    },
    "subject": {
      "id": "u1"
    },
    "action": "read",
    "environment": {}
  }
}

Examples

{
  "resource": {
    "ownerId": "u1"
  },
  "policy": {
    "rules": [
      {
        "effect": "allow",
        "id": "own",
        "condition": {
          "attribute": "resource.ownerId",
          "op": "eq",
          "value": "u1"
        }
      }
    ]
  },
  "subject": {
    "id": "u1"
  },
  "action": "read",
  "environment": {}
}

{
  "decision": "allow",
  "matchedRules": [
    "own"
  ],
  "evaluationTrace": [
    {
      "ruleId": "own",
      "applicable": true,
      "effect": "allow"
    }
  ]
}

{
  "resource": {
    "ownerId": "u1"
  },
  "policy": {
    "combiningAlgorithm": "deny_overrides",
    "rules": [
      {
        "effect": "allow",
        "id": "allow-owner",
        "condition": {
          "attribute": "resource.ownerId",
          "op": "eq",
          "value": "u1"
        }
      },
      {
        "effect": "deny",
        "id": "deny-read",
        "condition": {
          "attribute": "action",
          "op": "eq",
          "value": "read"
        }
      }
    ]
  },
  "subject": {
    "id": "u1"
  },
  "action": "read",
  "environment": {}
}

{
  "decision": "deny",
  "matchedRules": [
    "allow-owner",
    "deny-read"
  ],
  "evaluationTrace": [
    {
      "ruleId": "allow-owner",
      "applicable": true,
      "effect": "allow"
    },
    {
      "ruleId": "deny-read",
      "applicable": true,
      "effect": "deny"
    }
  ]
}

Recommended use cases

• Attribute-based access checks with an auditable trace
• Preview policy outcomes before enforcing them in your app
• Combine allow and deny rules with explicit combining algorithms

Avoid for

• Simple role-only checks (use identity.evaluate_rbac)
• Storing or versioning policies
• Executing unrestricted expression languages

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags