ALFA Language Basics

PolicySet

A PolicySet is the topmost structural element in an ALFA policy. It can contain PolicySet and Policy elements. A PolicySet contains a Target to scope access. Use PolicySet elements to organize your policies into logical building blocks e.g. use cases, business applications, and features.

Policy

A Policy is the second structural element in an ALFA policy. It can contain Rule elements only. A Policy contains a Target to scope access. Use Policy elements to organize your rules into logical building blocks e.g. use cases, business applications, and features.

Rule

A Rule is the third and last structural element in an ALFA policy. It contains the effect of the overall policy i.e. either Permit or Deny. A Rule contains a Target to scope access. It can also contain a Condition Use Rule elements to define the actual permissions you want to grant or deny.

Target

A Target is a simple way to match an incoming authorization request with a policy. In a target, you can compare an attribute to a value e.g. role=="manager". You can also use and and or to combine attribute comparisons e.g. role=="manager" and action=="view" and object=="financial record". Of all the functions available in ALFA, only those that compare an attribute to a value (e.g. string equality) can be used in a Target. For a complete list of functions, check out the ALFA Function Reference.

When to use Targets?

Use Target for simple matching or scoping. Break down your authorization challenge into simple statements you can then use in your Target.

Condition

A Condition is a more advanced way to match an incoming authorization request with a policy. You are free to use any of the functions available in ALFA in any structure you see fit. You can nest as many functions as you like. Conditions are particularly useful to implement relationships. If for instance, you want to grant a user access to a record because they are in the same department or because the user's clearance is greater than the record's classification, then you use a Condition.

• user.clearance>record.classification // Permit if the user's clearance is high enough
• user.department==record.department // Permit if the user is in the same department as the record

When to use Conditions?

Use Condition for advanced logic, attribute manipulation, or relationships.

Built-in conflict resolution

One of the coolest features of ALFA is its ability to organize, stack up, mix, and match policies. It means you can have a policy that will grant managers access to records and another that will deny access outside office hours.

Now, of course, if you have such policies, you need to decide which one wins. That's why ALFA comes with built-in conflict resolution. The mechanism used to handle conflicts is called a combining algorithm. It is defined at the level of the PolicySet or Policy parent element and it applies to that element's children.

ALFA Combining Algorithms Definitions

• denyOverrides: any of the children returns Deny, then evaluation is stopped and Deny is returned. View Truth Table.
• permitOverrides: any of the children returns Permit, then evaluation is stopped and Permit is returned. View Truth Table.
• firstApplicable: as soon as a child returns either of Permit or Deny, then evaluation is stopped and that decision is returned. View Truth Table.
• orderedDenyOverrides: same as denyOverrides. Order is strictly enforced. View Truth Table.
• orderedPermitOverrides: same as permitOverrides. Order is strictly enforced. View Truth Table.
• denyUnlessPermit: any of the children returns Permit, then evaluation is stopped and Permit is returned. Otherwise, Deny is returned. View Truth Table.
• permitUnlessDeny: any of the children returns Deny, then evaluation is stopped and Deny is returned. Otherwise, Permit is returned. View Truth Table.
• onlyOneApplicable: only one of the children must apply and return a decision. That decision is the overall decision, either Permit or Deny. View Truth Table.
• onPermitApplySecond: the decision coming from the first child is Permit, then return the decision from the second child, otherwise return the decision from the third child (if any). View Truth Table.

ALFA Combining Algorithm Truth Tables