Policy Engine

What is a policy engine?

A policy engine is a software component that lets an organization define, evaluate and audit access rules across its systems. It provides a central point of control for policy, so rules are managed once rather than in every application.

Policy engines evaluate each incoming request against a set of predefined policies, which may be written as code, stored in configuration files or held in an external database, and return an allow or deny decision. A policy engine is the policy decision point (PDP) in a an access control architecture. Many also include the policy administration point (PAP) role, and some include the policy information point (PIP) role. The engine decides; a policy enforcement point (PEP) enforces the decision. The components below map those roles. 

What are the components of a policy engine?

A typical policy engine has three components:

• Policy repository (PAP role). Stores the policies the engine evaluates. It can be a file, a database, a version-controlled code repository or a cloud service. 
• Policy evaluator (PDP role). Compares each incoming request against the policies in the repository, using pattern matching and rule-based logic, and returns an allow or deny decision.
• Policy administration interface (PAP role). Lets administrators create, update and delete policies and monitor the engine's operation.

What are the benefits of a policy engine?

Centralized policy management. Rules are defined and maintained in one place rather than in every application, simplifying their management across large, distributed systems. 

Flexibility. Policies can be updated as requirements change without modifying the applications that depend on them. 

Consistency and auditability. Every request is evaluated against the same set of rules, which reduces the gaps that inconsistent or outdated policies create. Engines can also log each decision, giving security teams a record to investigate. 

How to implement a policy engine

Implementing a policy engine takes three steps:

1. Define the policies. Base them on the organization's business rules and security requirements, and document them clearly so they're applied consistently. 

2. Choose the engine. Weigh the complexity of your policies, the size of the system and the performance you need. Open Policy Agent (OPA) is a widely used general-purpose option. 

3. Integrate it. Load the policies, connect the engine to the enforcements points that will call it, and test in audit-only mode before enforcing. 

More policy engine resources 

Blog

How Policy-based Access Control Improves Agility and Security