Pre-execution control

Intent, context, policy, and decision

A policy evaluates an intent in context; it must not be replaced by a preference or assumption.

Back to track

Objectives

  • Distinguish the four objects.
  • Identify missing attributes before a decision.
Duration
10 min
Level
Foundational

Prerequisites

  • Automated action lifecycle

Concepts

Concepts

  • Intent

    A bounded description of the requested action, distinct from its outcome and authorization.

  • Context

    Relevant attributes of the subject, object, action, and environment at the time of the decision.

  • Policy and decision

    The policy expresses the rules; the decision records their outcome for that specific context.

  • Policy engine and evidence mechanism

    The engine evaluates a rule; the evidence mechanism retains a bounded trace. An obsolete or incomplete policy can wrongly allow or deny, and a faithful trace does not repair it.

Visual guide

Building a decision

  1. Describe the intent.
  2. Gather context attributes.
  3. Evaluate the policy.
  4. Return allow, deny, or review.

Synthetic example

Synthetic example

An intent is structurally valid, but the amount limit is missing from context. The decision remains deny or review.

Missing data must not be invented.

Lesson scope

This lesson provides a model for documenting the input and output of a policy decision.

What this lesson does not demonstrate

It demonstrates neither a deployed policy engine, a verified identity, nor effective enforcement.

Check question

What should happen when an attribute required by the policy is missing?

What should happen when an attribute required by the policy is missing?

Choose an answer to read its feedback.

Guided local activity

Missing condition

Choose the most cautious decision when identity is known but authorized scope is missing.

This scenario evaluates no real identity or policy.

Local checklist

Decision table

Write the columns for a fictional decision.

Do not use any real identifier or attribute.

Sources and limitations

Sources and limitations

Source repository
https://github.com/SwissTokint/swisstokint-website
Source reference
codex/learning-hub-v3-autonomous-controls
Content commit
29c88f79cee07a72804bc017b92fab9200fd3734
Source version
learning-v3
  • Guide to Attribute Based Access Control (ABAC) Definition and ConsiderationsNIST-SP800-162
    Publisher
    National Institute of Standards and Technology (NIST)
    Version or date
    Final; updates through 2019-08-02
    Link verified on
    2026-08-13
    Scope used
    Definition of subject, object, action, and environment attributes evaluated against a policy.
    Limitation
    The guide does not prove that a deployment applies the decision.
  • Zero Trust ArchitectureNIST-SP800-207
    Publisher
    National Institute of Standards and Technology (NIST)
    Version or date
    Final, 2020-08
    Link verified on
    2026-08-13
    Scope used
    Principles of explicit decisions and resource-centred access.
    Limitation
    A reference architecture is not evidence of conformity.