Zero-Trust Policy Forge — Make Least Privilege Executable
Model identity, posture, context, and ordered rules; then watch default deny, corpus mismatches, shadowed policy, and blast radius become visible evidence instead of security folklore.
What this is
Zero-Trust Policy Forge is a local-only authorization laboratory. Choose a deterministic request or compose your own from modeled identities, devices, resources, actions, and context; then walk the ordered policy stack predicate by predicate until the first match decides—or the implicit final rule denies it. Edit, reorder, duplicate, tighten, or widen rules and the sixteen-case corpus, rule reachability, weighted blast radius, and least-privilege score all recalculate from the same evaluator.
Why this is mind-blowing
“Least privilege” usually survives as a diagram and a promise. Here it is executable, falsifiable, and portable: an unmanaged tablet, stale session, off-hours administrator, or attested service call leaves a visible trace; a careless grant immediately becomes an over-permission count and a larger blast radius; a duplicated rule reveals itself as shadowed. The policy does not merely say what should happen—it proves what will happen.
Prompt
Build “Zero-Trust Policy Forge — Make Least Privilege Executable,” a safe defensive single-file policy simulator. Let users define/select identities, devices, resources, actions, context, and ordered policy rules; evaluate requests with a visible decision trace and default deny. Include deterministic scenarios such as normal employee access, unmanaged device, expired session, off-hours admin, and service-to-service request. Let users tighten/widen rules, run a request corpus, surface over-permission/under-permission counts, unreachable/shadowed rules, blast-radius score, and a least-privilege score. No offensive exploitation content. Include export/import with strict validation, reset, keyboard/touch/accessibility, phone layout, reduced motion. Inline HTML/CSS/JS, no dependencies/assets/network/build, <=160KB.Paste into your favorite AI and adapt it to your context.
What I learned shipping it
- Default deny becomes trustworthy only when the interface shows every failed predicate and the exact first rule that made the decision.
- A deterministic request corpus turns least privilege into a regression target: over-permission, under-permission, and blast radius move the moment a rule changes.
- Enumerating a bounded policy universe is enough to expose unreachable and fully shadowed rules before dead configuration becomes operational ambiguity.