Local policy laboratory · defensive only

Zero-Trust Policy Forge

Turn identity, posture, context, and ordered rules into an inspectable answer. Every request is verified. Every unmatched request is denied. Every score can be traced back to a modeled decision.

Default deny No network or storage Deterministic corpus

request → ordered rules → first match → default deny

01 · Request

Compose an access request

5 scenarios
10:00
DENY Default deny

No rule has been evaluated yet.

Visible decision trace

    Model inventory — define identities, devices, resources, and actions

    02 · Policy

    Ordered first-match rule stack

    8 rules
    Implicit default deny Executed only when no enabled rule matches.
    DENY

    03 · Assurance

    Least-privilege evidence

    lower blast is better
    Least-privilege score
    0 out of 100

    Run the deterministic corpus to measure correctness, reachability, and modeled exposure.

    Blast radius modeled exposure
    Corpus accuracy expected vs actual
    Over-permission denied by need, allowed by policy
    Under-permission needed, but denied by policy
    Unreachable rules match no modeled request
    Shadowed rules always preempted earlier

    Rule diagnostics

      How the scores are calculated

      The bounded universe combines every modeled identity, device, resource, action, and seven deterministic contexts. First-match evaluation is identical everywhere.

      blast = weighted allowed scope ÷ weighted modeled scope × 600, capped at 100
      least privilege = 100 − 12×over − 8×under − .35×blast − 4×unreachable − 6×shadowed − 5×broad allow

      Deterministic request corpus

      Not run yet.

      Case Need Policy Class
      Keyboard controls

      E evaluate · C run corpus · N new rule · [/] select rule · Alt + / reorder · Ctrl/ + S export/import.

      Policy rule editor

      New rule

      Ownership
      Runtime

      Trust model editor

      Add identity

      Portable policy data

      Export / import

      Export validated JSON

      Deterministic text only: no timestamps, code, credentials, or hidden state.

      Import with strict validation

      Exact schema, known enums, bounded arrays, referential integrity, safe keys, and a 160KB limit.