> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/pbac.md).

# Decide access with policies

Author, simulate and safely roll out Cedar-based access policies that decide requests on attributes and context, alongside the entitlements a user already holds.

## What this is, and when you need it

**Policy-based access control** (**PBAC**) answers a question entitlements cannot. An entitlement records *what has been assigned to a user*. A policy decides *whether this particular request should be allowed*, given who the user is, what they are reaching for, and the circumstances — the time of day, the content provider the request arrived through, an attribute on the user's record.

You need this section when a rule cannot be expressed as a membership. "Contractors may reach this application, but only during working hours" is not a role you can grant; it is a condition on every request. PBAC is where that lives.

It does not replace the access model. Policies run **alongside** roles, groups, resources and access rights, and they read those entitlements as attributes — a policy can ask whether a user holds a role without that role being what decides the request. If you are looking for how access is assigned in the first place, that is [Model and grant access](/administration-guide/access.md).

New in **2026.8.1**, delivered by its own `pbac-manager` microservice with its own `pbac` database, and managed from **Administration → PBAC Policies** in the Webconsole.

{% hint style="danger" %}
**An ACTIVE policy with no enforcement mode recorded is enforced.** The staged rollout — `SHADOW`, then `PARTIAL`, then `FULL` — is opt-in, not the default. A policy activated without a mode set governs every request it matches, immediately. Read [Roll a policy out safely](/administration-guide/pbac/roll-out-a-policy.md) before you activate anything, because a wrong policy locks real users out of real systems.
{% endhint %}

## Start here

1. [The policy model](/administration-guide/pbac/policy-model.md) — Cedar, the entities OpenIAM exposes to it, and how a decision is actually reached. Read this first; the rest assumes it.
2. [Create a policy](/administration-guide/pbac/create-a-policy.md) — the form builder, the Cedar editor, and why versions are immutable.
3. [Simulate a policy](/administration-guide/pbac/simulate-a-policy.md) — evaluate it against real users and resources while it affects nothing.
4. [Roll a policy out safely](/administration-guide/pbac/roll-out-a-policy.md) — shadow, partial and full, and the order to take them in.
5. [Trace a decision](/administration-guide/pbac/trace-a-decision.md) — why one request was refused, and which policy refused it.

## How a decision is reached

Two rules decide everything, and both are Cedar's rather than OpenIAM's:

* **Forbid wins.** If any applicable policy forbids the request, it is denied — no matter what else permits it.
* **Default deny.** If nothing permits the request, it is denied. A request that matches no policy at all is refused, not allowed.

Every applicable policy is merged and evaluated in a single engine call, so those semantics apply across the whole policy set rather than policy by policy.

## What this section does not cover

* **Assigning access.** Roles, groups and access rights are [Model and grant access](/administration-guide/access.md).
* **Certifying access.** Reviewing what people hold is [Govern access](/administration-guide/governance.md).
* **Authenticating the user.** A policy decides what an already-authenticated user may do — [Secure sign-in and credentials](/administration-guide/security.md).

## Related

* [PBAC reference](/administration-guide/pbac/pbac-reference.md) — the service, its dependencies, cache intervals, configuration properties and REST API
* [The access model](/administration-guide/access/access-model.md) — the entitlement model policies read from
* [Find audit evidence](/administration-guide/operations/find-audit-evidence.md) — PBAC decisions are audit events, so everything there applies to them

*Applies to OpenIAM 2026.8.1. Last reviewed 13 August 2026.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/administration-guide/pbac.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.