Decision log
The Decision Log tab shows every PBAC authorization decision the engine has served, newest first. Simulation runs are not shown — they govern no real access.
The log is not a separate store: PBAC decisions are recorded in the OpenIAM audit log (as PBAC REQUEST events), and this screen is a view over it narrowed to policy decisions. The same entries are therefore visible in the Log viewer and can be forwarded to syslog like any other audit event.
Filtering
Results can be filtered by principal id, resource id, decision (ALLOW / DENY) and a from/to time range. Filters are applied when you click Search.
What each entry records
| Field | Description |
|---|---|
| When | The decision timestamp. |
| Principal / Resource / Action | The fully-qualified Cedar identities of the request (e.g. Openiam::User::Human::"3000"). |
| Requested by | The caller that asked for the decision. |
| Decision | ALLOW or DENY — the decision that was served. |
| Policies | The determining policies, so a refusal can be traced to the rule that caused it. |
Beyond the columns shown on screen, each audit entry also records how every applicable policy participated in the decision — applied, observed (shadow) or skipped (outside a partial rollout) — together with the enforcement mode in force at decision time (a PARTIAL policy including its rollout percentage). Shadow policies additionally record what they would have decided, as informational text. These attributes can be inspected on the underlying audit entry in the Log viewer.