Policymaker security and testing

Use this skill when

• You are reviewing a policy for security correctness.
• You need to write tests for authorization behavior.
• You must verify deny-by-default, explicit deny precedence, or tenant isolation.
• You are auditing role inheritance, ownership checks, or ABAC predicates.

Security model

Policymaker answers one question: may this subject perform this action against this data? It is deterministic and synchronous with no hidden I/O.

What the application owns