Policy Decision Point (PDP)
What is a policy decision point?
A policy decision point (PDP) is the component of an access control system that evaluates each access request against policy and context, then returns a decision to allow, allow with conditions or deny. It doesn't enforce anything itself. That job belongs to the policy enforcement point (PEP).
The PDP is one of four roles in a policy-based access model, defined by the eXtensible Access Control Markup Language (XACML) and adopted in the National Institute of Standards and Technology (NIST) zero trust architecture (SP 800-207):
- Policy administration point (PAP). Where you write and manage policies.
- Policy information point (PIP). Supplies context such as user attributes, device posture or time.
- Policy decision point (PDP). Evaluates the request and makes the call.
- Policy enforcement point (PEP). Sits in the request path and carries out the decision.
What does a PDP do?
The PDP is the single source of truth for authorization decisions. Instead of every application, server or database deciding access by its own rules, enforcement points ask the PDP. If you change a policy once, it takes effect everywhere, and every decision lands in one log, in one format, for audit.
The PDP does not define or store policies; it interprets them. Policy definition belongs to the PAP, and any extra context the PDP needs, such as device state or time of day, comes from the PIP.
How does a PDP work?
A PDP handles each request in four steps:
1. Receive the request. A PEP intercepts an access attempt (a user connecting to a database, a service calling an API, an AI agent invoking a tool) and asks the PDP for a decision.
2. Gather context. The PDP pulls attributes from the PIPs: the identity and its groups, device trust, location, time and the sensitivity of the target resource.
3. Evaluate policy. The PDP checks the request and its context against the relevant policies. Well-designed systems are default-deny; if no policy explicitly allows the request, it's denied.
4. Return the decision. The PDP sends back allow, deny or allow with conditions, such as requiring multi-factor authentication (MFA), requiring approval or masking specific fields. The PEP enforces it, and the PDP logs the decision.
Why does a PDP matter?
Separating decisions from the enforcement gives you three things and one trade-off:
- Consistency. One policy applies the same way at every enforcement point, so rules don't get reimplemented in each application and drift apart.
- Context-aware access. Decisions can weigh the conditions of the request, such as device posture, location or the risk of a specific action, not just a static role. That's what makes policy-based and attribute-based access control practical.
- Auditability. The PDP records every decision in one place, which simplifies investigations and compliance evidence.
- The trade-off. A PDP sits in the access path, so latency and availability matter. Teams address this with distributed enforcement, caching or evaluating policy closer to the workload.
Open Policy Agent is a widely used general-purpose PDP. In access management, a Privileged Access Management (PAM) platform's authorization engine plays the same role for every privileged session, and the same model now extends to AI agents, where each tool call can get its own policy decision.
More resources
Blog
How Policy-based Access Control Improves Agility and Security