Decision Nodes

Decision Nodes are the runtime component of Denied Platform. They evaluate authorization requests against your policies in real-time, returning allow or deny decisions to your applications. This guide covers setup, configuration, and integration.

Overview

A Decision Node is a server that:

1. Pulls policies from your Denied project (as OPA bundles)
2. Receives authorization requests from your applications
3. Evaluates requests against loaded policies using OPA
4. Returns allow/deny decisions
5. Logs decisions for monitoring and audit

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  Your App   │────▶│  Decision   │────▶│   Denied    │
│             │◀────│    Node     │◀────│  Platform   │
└─────────────┘     └─────────────┘     └─────────────┘
    Request            Evaluate           Pull Policies
    Response           Decision

Using the Playground

The Policy Playground in the dashboard sends requests to your configured Decision Node:

1. Go to Governance → Playground
2. Enter subject, action, and resource details
3. Click Evaluate
4. View the decision and matched rules

Monitoring

Decision Logs

When telemetry is enabled, all authorization decisions are logged. View them in:

1. Go to Monitoring → Logs
2. Filter by time period, effect (allow/deny), or search
3. Click on entries to see full request details

Related

• Projects — Configure project settings
• Policies — Create authorization policies
• Testing Policies — Test in the Playground