01 · Request
Compose an access request
DENY
Default deny
No rule has been evaluated yet.
Visible decision trace
Model inventory — define identities, devices, resources, and actions
02 · Policy
Ordered first-match rule stack
∞
Implicit default deny
Executed only when no enabled rule matches.
DENY
03 · Assurance
Least-privilege evidence
Least-privilege score
—
Run the deterministic corpus to measure correctness, reachability, and modeled exposure.
Blast radius
—
modeled exposure
Corpus accuracy
—
expected vs actual
Over-permission
—
denied by need, allowed by policy
Under-permission
—
needed, but denied by policy
Unreachable rules
—
match no modeled request
Shadowed rules
—
always preempted earlier
Rule diagnostics
How the scores are calculated
The bounded universe combines every modeled identity, device, resource, action, and seven deterministic contexts. First-match evaluation is identical everywhere.
blast = weighted allowed scope ÷ weighted modeled scope × 600, capped at 100
least privilege = 100 − 12×over − 8×under − .35×blast − 4×unreachable − 6×shadowed − 5×broad allow
Deterministic request corpus
Not run yet.
| Case | Need | Policy | Class |
|---|
Keyboard controls
E evaluate · C run corpus · N new rule · [/] select rule · Alt + ↑/↓ reorder · Ctrl/⌘ + S export/import.