Runs evaluatePolicy from @better-iam/core in your browser

Policy playground

Edit grant and boundary documents, describe a request, and watch the decision and its statement-by-statement trace update as you type. Nothing leaves this page; share a scenario with a link. Learn the model in Policies and Conditions.

Everyone reads; only the owner writes. ${principal.id} is substituted literally before matching.

Grant documents come from the roles and policies bound to the principal. Their allows form a union.

grant:0 valid

{
  "version": 1,
  "statements": [
    {
      "sid": "ReadAll",
      "effect": "allow",
      "actions": [
        "documents:read"
      ],
      "resources": [
        "document/*"
      ]
    },
    {
      "sid": "EditOwn",
      "effect": "allow",
      "actions": [
        "documents:write"
      ],
      "resources": [
        "document/*"
      ],
      "conditions": {
        "StringEquals": {
          "resource.ownerId": "${principal.id}"
        }
      }
    }
  ]
}

Add a condition without editing JSON

The statement applies only when the context value is exactly one of these texts.

StatementOperatorContext keyValue

Request

ActionResource

Context

{
  "principal.id": "usr_alice",
  "resource.ownerId": "usr_alice"
}

Keys the server provides

Allowedreason: allowed

Allowed. At least one grant statement allows the request, no statement denies it, and every boundary allows it.

grant:0:EditOwn

Statement trace

grant:0:ReadAllallowdid not match
actionresourceno conditions
grant:0:EditOwnallowmatched
actionresource
- StringEqualsresource.ownerIdexpects "${principal.id}"got "usr_alice"