policy

Overview ¶

Package policy is wowapi's ABAC condition engine: it evaluates a policy's conditions against an attribute bag using a closed operator set. It is the PolicyEngine kernel/authz delegates to, kept separate so the matching logic is small, pure, and independently testable (blueprint 01 §3 step 5).

Operators never execute arbitrary expressions; each is a fixed comparison, so a policy row can constrain but never inject behavior.