Policy engine
Raise or lower the required factors for a zone without a firmware flash. The compiler enforces the tenant floor, not the toggle in the interface.
A policy is compiled, hashed, and attributable.
Interpreted rules drift. A compiled artifact with a hash can be pinned to an audit finding months later.
A policy pack is structured data: a tenant floor, threat class definitions, fusion weights, and an ordered list of rules. Publishing compiles it into a deterministic artifact and records the hash of that artifact as its revision.
Evaluation is deny-overrides first, then the highest-priority matching permit. A missing attribute evaluates as undefined, and comparisons against undefined are false rather than permissive. Rules cannot accidentally open a door by referencing an attribute that was never populated.
Enforcement points at the edge evaluate their cached compiled snapshot, which is why a broker outage cannot open a door. Every decision written to the audit trail carries its policy revision, so the question of what the rules were at 03:00 on a Tuesday has a definite answer.
- Enforcement points
- Strike, desktop unlock, token issue, network access
- Decision point
- The session authority in the control plane
- Information sources
- Directory, groups, locations, assets, gate passes, threat feed, clock
- Algorithm
- Deny overrides, then highest-priority permit
- Undefined attributes
- Comparisons evaluate false, never permissive
- Default decision
- Deny on interlocks, configurable on turnstiles
- Artifact
- Compiled, content-hashed, immutable
- Edge behaviour
- Evaluates its cached snapshot when isolated
The modality ladder.
Each rung names what must corroborate before somebody passes. A zone sits on a rung; the threat class can move it up; only dual control can move it below the tenant floor.
card_onlyCredential decrypt, access list, strike. No biometric weight at all.card_plus_async_bioThe strike releases on the credential. Gait and face attach to the session behind it.card_plus_gaitGait must corroborate within roughly two strides.card_plus_faceFace must corroborate the claimed principal one to one.card_plus_gait_and_faceBoth modalities fused into a single composite score.interlock_fullThe second door holds until the composite score clears the admit threshold.One lever a security lead can actually pull.
Threat class is an input to evaluation, not a rewrite of the rules. Setting it publishes to every site, and the next credential presented re-evaluates under the new context.
| Threat class | Portals | Desktops | Contractors |
|---|---|---|---|
| Green | Zone floor applies as configured | Standard idle and lock thresholds | Normal access by group |
| Amber | Gait and face can both become required | Idle window halved, step-up after a foreign-face lock | Escorted zones only |
| Red | Interlocks hold, asynchronous portals escalate | Remote lock permitted on connectivity loss | Access can be denied outright |
Publishing a change.
The interface is a drafting tool. The compiler is the enforcement point.
Draft against a real context
Build the rule and evaluate it against a concrete context object: this principal, this portal, this hour, this threat class. You see the decision and the rule that produced it before anything is published.
The compiler checks the floor
If the pack would put any zone below the tenant floor, compilation fails. It does not warn and proceed. A card-only rule cannot appear in a pack whose floor starts a rung higher.
Dual control for a genuine exception
Where a drop is legitimately needed, two distinct administrators must approve the same compile. Both identities are recorded against the artifact.
Fan out and attribute
The compiled pack reaches every site, and agents apply new thresholds on receipt. From that moment every decision log carries the new revision hash.
An approved gate pass appears in the decision context as an attribute the rules can read, scoped to a named portal and a time window. It does not create a side door, and it does not silently drop that portal to card-only.
Guarantees worth writing down.
One pack, every enforcement point
The strike, the lock screen, and token issuance all consult the same compiled rules.
Dry run
Evaluate a context object and see the decision before publishing.
Attribution
Every decision log carries the pack hash and the matched rule.
Compile as a change record
Publishing a policy is an auditable change with named approvers.
Objection handling
A recorded objection to biometric processing is a legal configuration, not an engineer's override.
Per-site overlays
Local rules on cameras and works councils can overlay a global pack.
Related
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.