Policymaker framework integration

Use this skill when

• You are adding authorization to Express, Hono, Fastify, Next.js, GraphQL, tRPC, or background job handlers.
• You need to map AuthorizationError to framework-specific error responses.
• You are building middleware or pre-handler hooks that enforce authorization.
• You must decide between can(), require(), batch(), and evaluate().

Core principle

Authorize at the trusted server-side boundary after loading all required data and before performing the protected operation. Browser checks are not enforcement boundaries.

Loading data before evaluation