Engine modes

Contextual Authorization Query (CAQ) mode is an ADS operating mode that exposes the CAQ evaluation API to perform reverse queries.

A reverse query response provides information on what conditions need to be satisfied to get an expected decision. Such a process can then be used to answer questions like “Is there a request that evaluates to Deny?” or “Can one ever get an Indeterminate response from the PDP?”. In addition, reverse queries can determine some attribute values in order to get a sub-set of the conditions that need to be met for a decision. In this way, a reverse query can be used to answer questions like “Which documents can be accessed by employees working in the Sales department?” or “Can user Alice access any document from the Sales Department with security classification ‘Confidential’?”.

Reverse queries are a powerful tool, not only for analyzing policies but, more significantly, for speeding up multiple access requests.

ADS modes

ADS supports three engine modes, which you select by setting the mode property under the engine section of deployment.yaml:

Mode	Property value	Description
ADS only	ads	The core authorization service, including AuthZEN endpoints. CAQ is not available. This is the default.
ADS with CAQ	ads_caq	The core authorization service (including AuthZEN endpoints) combined with CAQ functionality in a single deployment.
CAQ only	caq	A specialized deployment of CAQ alone, without AuthZEN endpoints.

When to use CAQ mode

Use the caq (CAQ only) mode when you need to run the CAQ API as a dedicated, independently scalable service, separate from the core ADS authorization service.

Use the ads_caq (ADS with CAQ) mode for:

• Proofs of concept (POCs)
• Pre-production or low-performance environments
• Situations where running a single combined service is sufficient

caution

The combined ads_caq mode is not recommended for production environments where both ADS and CAQ are under load. For production, deploy ADS and CAQ as separate services to ensure optimal performance and scalability.

note

Make sure you have the appropriate license for your selected mode. Contact Axiomatics if you are unsure which license covers CAQ.

Deploy ADS in CAQ mode

Configure the engine mode

Set the mode property in the engine section of your deployment.yaml file:

engine:
  mode: caq

To run both ADS and CAQ from the same deployment, use:

engine:
  mode: ads_caq

Other relevant properties

In addition to the engine.mode property, review the following configuration areas when deploying in CAQ mode:

• License: confirm your license file covers the CAQ mode you have selected.
• Service ports: CAQ endpoints listen on the same configured port as ADS by default. See Configure ADS for port configuration.
• Authentication: the same authentication configuration applies to CAQ endpoints. See Configure ADS for authentication options.
• Domain: CAQ mode also requires a valid authorization domain at startup.

Verify CAQ mode is active

After you start ADS, confirm that CAQ mode is active by checking the application logs at startup. When ADS starts in ads_caq mode, the following entries appear during initialization:

… INFO … com.axiomatics.audit.arq.raw.admin       : Initializing Contextual Authorization Query with identifier: default

note

The identifier value reflects identity.constant in deployment.yaml. When identity.constant is not set, ADS uses default. See ADS instance identity.

You can also send a request to the health endpoint to confirm the service is running:

GET http://localhost:8080/health

note

By default, management endpoints (including /health) are accessible on server.port (default: 8080). If you have configured a separate management.server.port, use that port instead. See Configuration reference.

A successful response returns 200 OK. See Healthcheck endpoints for details on interpreting the response.