Essal Guard provides policy-based access control that sits on top of the role system. Policies allow you to define fine-grained rules — allowing or denying specific actions on specific resources — beyond what roles alone can express.
How Policies Work
Guard evaluates every API request in the following order:
- Explicit Deny: If any matching policy explicitly denies the action, it is blocked regardless of roles
- Role Allow: If the user’s roles grant the action, it is permitted
- Policy Allow: If a policy explicitly allows the action, it is permitted
- Default Deny: All other requests are denied
Creating a Policy
Policy Components
Conditional Policies
Add conditions to make policies context-aware:
Testing a Policy
Before activating a policy, test it against a hypothetical request:
Test policies thoroughly before activation. A misconfigured deny policy can lock users out of resources. Use "status": "inactive" to draft policies before enabling them.
