Policy Layer (Thin Policy-as-Code)

Purpose

This layer adds declarative governance checks on top of existing permission guards. It does not replace RBAC and does not change JWT/auth flow.

Permission vs Policy

• Permission:
  • Atomic capability token (for example roles:request.review).
  • Evaluated by RBAC permission evaluator.
• Policy:
  • Declarative rule set that includes a permission plus optional account/identity gates.
  • Example fields:
    • permission
    • requiresActiveAccount
    • requiresVerifiedIdentity

Policy is a higher-level contract. Permission is one input to policy.

Current package

• @kvary/policy-domain