Glossary

Access token

The token the authorization server issues after a policy decision. A client presents it to a resource or to the managed gateway. The tokens in our runs were opaque strings, so a resource server learns what a token grants by calling /introspect.

Audit log

The record of each decision, with the input the policy engine received (policyInput) and the decision it returned (policyDecision). The Admin Portal shows it as Access Activity. The Admin API serves it at /admin/api/audit-logs.

AuthZEN

An OpenID standard for asking an authorization question directly. PolicyArc answers it at /access/v1/evaluation. That endpoint does not run custom controls.

Binding

A row entry that adds settings to one control for the requests that a list of segments describes. Bindings live in the pbac.operator.segments row. Only controls that read their settings through the segment resolver see them. See Controls and segments.

Bundle

The gzipped tar file of Rego files and data.json that the authorization server builds from its rules and data rows. OPA fetches it from /bundles/pbac/bundle.tar.gz.

CIMD

Client ID Metadata Document. A client that registers this way uses a URL as its client_id, and the server reads the client's metadata from that URL. Its registration_type is CIMD.

Connector

A packaged integration with an upstream service, such as Jira or Google Drive. A connector manifest defines the routes and tools the managed gateway exposes, and a connector can ship Rego under pbac.connectors. See Connectors.

Control

One named piece of policy behaviour, such as the denylist. A shipped control has a manifest, Rego, and usually a data row of settings. A custom control is a Rego package you add under pbac.controls. See Controls and segments.

Control data

The data row that holds a control's settings, named pbac.operator.controls.<control>. You change the control by writing the row. See Control data.

DCR

Dynamic Client Registration (RFC 7591). A client registers itself at /register, with a software statement or without one.

Deny reason

An object a control adds to deny to refuse an action. It carries a code and an area, and the audit log keeps it in deny_reasons.

Denylist

The shipped control that refuses listed clients, subjects, redirect domains, software ids and issuers. Its row is pbac.operator.controls.denylist.

DPoP

Demonstrating Proof of Possession (RFC 9449). A client proves it holds a private key with a signed DPoP header, and the token is bound to that key.

Entitlement

The grant types a client may use and the scopes of each resource type it may receive. It comes from the client entitlements row or from the client's software statement. See Clients and access.

JIT single-use token

A token that works for one successful introspection. A control makes a token single use by setting jit_single_use. A second introspection of the token is refused as already consumed.

Managed gateway

The policy enforcement point built into the authorization server. It proxies calls to managed resources at /gateway/<name>/... and MCP calls at /gateway/mcp, and checks each call with policy first.

Obligation

An instruction a decision attaches to a grant. A subject obligation is enforced by the authorization server before it issues the token, for example a required approval. A resource server obligation, in rs_obligations, is passed to the resource server at introspection for it to enforce.

OPA

Open Policy Agent. The policy engine that evaluates PolicyArc's Rego. It runs beside the authorization server.

PDP

Policy decision point. The component that decides. In PolicyArc this is OPA, evaluating the bundle the authorization server built.

PEP

Policy enforcement point. The component that acts on a decision, refusing or allowing a call. The managed gateway is one. A resource server that calls /introspect before it answers is another.

PIP

Policy information point. A source of facts that policy consults while it decides, such as a consent service.

RAR

Rich Authorization Requests (RFC 9396). A client describes what it wants in authorization_details instead of scopes alone. A resource type that only RAR can request needs a control to allow it with rar_allow.

Reason code

The code of a deny reason, or the single reason of a refused request, such as client_denied or all_resources_denied. The audit row of the decision carries it. Neither the audit API nor the Access Activity page filters by reason, so filter by client, subject, outcome or flow and read the code in the row.

Rego

OPA's policy language. See Rego for PolicyArc.

Resource type

A kind of thing a client can ask for, such as urn:mcp:server, with its list of scopes. Resource types live in the resource registry row, pbac.operator.controls.resource_registry.

Segment

A named group of requests, defined by tests on facts about the client, the resource or the identity. A binding uses segments to decide where its settings apply.

Software statement

A signed JWT that describes a client and what it may request. The server checks its signature and accepts it only from a trusted issuer. With PBAC_SOFTWARE_STATEMENT_VERIFY set to false (the default is true) the signature is not checked, so the issuer the statement names is taken on its word. Every claim reaches policy as input.context.client.software_statement.

Token exchange

The OAuth grant (RFC 8693) in which a client trades a token it holds, the subject token, for a new one. Policy sees the grant as urn:ietf:params:oauth:grant-type:token-exchange. See Delegation chains.