The most recent patch for this version is 26.2.1.  Learn more

Skip to main content

Introduction

Axiomatics Policy DevOps (APD) is a platform and a set of tools for developing, testing, and delivering authorization policies and attribute connectors. It is for developers who write policies and tests, and for DevOps engineers who build and run the pipelines that deliver them.

Policies are written in ALFA (Abbreviated Language For Authorization), the Axiomatics policy language. They implement Attribute-Based Access Control (ABAC), where access decisions are based on attributes of the user, the resource, the action, and the context, rather than on static role assignments. APD is built on Gradle and JUnit, so policies are developed like any other code: in your IDE, in Git, and in your build server.

What APD does​

  • Builds the authorization domain: compiles your ALFA policies, attribute dictionary, and attribute connectors into the authorization domain that the Access Decision Service (ADS) loads.
  • Tests policies: runs JUnit tests that send access requests to a local ADS and check the decisions.
  • Tests attribute connectors: runs the attribute connectors against mocked or real services, such as databases, LDAP, and HTTP services.
  • Shows how a decision was made: a visual trace of each test shows which policies and rules were evaluated.
  • Runs ADS locally: starts ADS with your authorization domain, so you can send it requests during development.
  • Works with Authorization Hub: pushes and pulls the dictionary, attribute connectors, policies, and the tested domain, and promotes domains between environments.
  • Delivers the authorization domain: through Authorization Hub, as the build context of the ADS container image, or as a domain.yaml for your own custom delivery.

Integrations​

APD integrates with the Axiomatics components, Authorization Hub and ADS, as well as with container platforms and build servers. The same Gradle tasks run on your machine and in your CI/CD pipeline, for example in Jenkins, Azure DevOps, or GitHub Actions.

Ways of working​

  • Specification-driven development: the tests are the executable specification of your authorization requirements. Each requirement, such as "a manager can approve the expense reports of their team", becomes a test that states the request and the expected decision. You write or change the specification first, then the policy until the tests pass.
  • AI-assisted development: APD projects contain an AGENTS.md file with instructions for AI coding agents, such as GitHub Copilot, OpenAI Codex, Cursor, or Claude Code. An agent can write policies and tests from your requirements, run the tests to check its own work, and update APD. The tests show you whether the result does what you specified.
  • Shift left: policies are tested early and on every change, test-first if you want, so defects are found during development instead of in production.
  • Policies as code: policies, attribute connectors, and tests are kept in Git, reviewed, versioned, and traced back to the commit they were built from.
  • Learning and experimentation: APD is a safe environment for learning ALFA and trying out policies and Axiomatics products.

Notices​

AXIOMATICS® is a registered trademark of Axiomatics AB, corporate identification no. 556708-1012, Sweden. Other trademarks are the property of their respective owners.

Except as otherwise expressly agreed in writing by Axiomatics AB, information in this document does not constitute in any way a representation, warranty or commitment on the part of Axiomatics.