Ask whether this agent may take an action
An OpenID AuthZEN 1.0 Access Evaluation request, answered by the policy that governs the calling agent: the organization’s rules, the tenant’s, and the agent’s own, under the roles the agent holds.
Any agent credential may call it (a key, or an access token for the
audience https://access.noetive.io). It never changes anything: a
decision is not an approval, and a service that enforces policy itself
(such as mail) makes its own decision.
What you send, and what you cannot. subject.id must be the agent
the credential belongs to, otherwise the request is 403 forbidden.
The subject carries nothing else: who the agent is, its tenant, roles
and organization come from its credential and are looked up by the
server. The resource type is fixed by the action (see the table
below) and id names it; the server finds its owner and the rest of
what it needs. Only a Commitment accepts properties, its amount.
The only context you may send is declared. A request that supplies
anything else, such as a role, a recipient flag or an authority mode,
is 400 invalid_request: it is refused, never ignored.
What the answer means. decision is true only when tier is
allowed. tier is requires_approval when a person must approve the
action first (file it with approvals/v1), and denied when it can
never be done as asked. rule_ids are the ids of the rules that
decided and messages their explanations, both empty when nothing
matched (the default is denied). Policy source is never returned.
What you declare can only describe the request, never relax it: a
declared classification can raise the sensitivity of a message and not
lower it, and a rule that forbids the action applies whatever is
declared. An action decided per recipient (mail.send, mail.send_as,
calendar.attendee.add) cannot be evaluated here, because recipients
are known only to the service that sends: it answers 503 policy_unavailable.
| Action | resource.type |
|---|---|
mail.read, mail.modify, mail.delete, mailbox.manage, mail.send, mail.send_as | Mailbox (an agent mailbox id) |
attachment.read | Attachment |
calendar.read, calendar.freebusy.read, calendar.event.create | Calendar |
calendar.event.update, calendar.event.cancel, calendar.event.respond, calendar.attendee.add | CalendarEvent |
contact.read, contact.create | AddressBook |
contact.update, contact.delete | Contact |
directory.read, directory.export, agent.provision | Tenant (your own tenant id) |
authority.read, authority.modify | Authority |
commitment.create | Commitment |
semantik.publish, semantik.search, semantik.subscribe | Namespace (a namespace id of your tenant) |
A resource the tenant does not own, or one the server cannot load,
is answered denied.

