Authorization you can read, test, and trust

Authorization for AI agents and MCP

AI agents call tools, access resources, and act on behalf of users. Each of these operations needs authorization that goes beyond allow or deny. SAPL evaluates policies inside your MCP server or AI framework, with full access to the request context. Policies can allow a tool call while attaching obligations: redact sensitive fields from the response, log the access, require human approval above a threshold, or cap a parameter value.

AI scenarios with working code

Decisions that stay current

Every authorization engine evaluates a request and returns a decision, and SAPL handles that case with zero overhead. The difference is what happens when context changes. Traditional engines have no way to revise the decision, so the application enforces a stale result until the next explicit check. With SAPL, the application subscribes to decisions and the PDP pushes updates whenever underlying attributes change. This is event-driven rather than polling, which reduces both latency and resource utilization. Toggle the threat level below and watch.

set "api activity access"
priority deny or abstain
for action == "monitorActivity"

policy "lockdown on critical"
deny
    "https://siem.local/threat"..level == "critical";

policy "full access for investigation"
permit
    "https://siem.local/threat"..level == "high";

policy "redacted by default"
permit
    "https://siem.local/threat"..level == "low";
obligation {
    "type": "filterJsonContent",
    "actions": [
        {"type":"blacken", "path":"$.user", "discloseLeft": 1},
        {"type":"blacken", "path":"$.ip"}
    ]
}

@EnforceRecoverableIfDenied
@GetMapping(
    value = "/api/activity",
    produces = MediaType
        .TEXT_EVENT_STREAM_VALUE)
public Flux<ApiEvent> stream() {
    return activityService
        .streamAll();
}

Use it with any stack

All integration modes support single and multi-subscriptions, streaming and one-shot decisions, and the full obligation/advice/resource transformation model.

// SpEL expressions reference method parameters with #name
@PreEnforce(
    action   = "'notifyParticipant'",
    resource = "{'recipient': #recipient, 'message': #message}"
)
public String notifyParticipant(String recipient, String message) {
    return notificationService.send(recipient, message);
}

# Lambda builds resource from route params and JWT secrets
@pre_enforce(
    action="proxy.php?url=exportData",
    resource=lambda ctx: {
        "pilotId": ctx.params.get("pilot_id", ""),
        "sequenceId": ctx.params.get("sequence_id", ""),
    },
    secrets=lambda ctx: {"jwt": ctx.request.state.token},
)
async def get_export_data(pilot_id: str, sequence_id: str):
    return {"pilotId": pilot_id, "data": "export-payload"}

// Arrow function accesses return value after execution
@PostEnforce({
    action: 'readRecord',
    resource: (ctx) => ({
        type: 'record',
        data: ctx.returnValue,
    }),
})
@Get('record/:id')
getRecord(@Param('id') id: string) {
    return this.records.find(r => r.id === id);
}

// ISubscriptionCustomizer builds the subscription programmatically
[HttpGet("exportData/{pilotId}/{sequenceId}")]
[PreEnforce(Action = "exportData", Customizer = typeof(ExportCustomizer))]
public IActionResult GetExportData(string pilotId, string sequenceId)
{
    return Ok(new { pilotId, sequenceId, data = "export-payload" });
}

# Lambda builds resource from route params, with JWT secrets
@pre_enforce(
    action="proxy.php?url=exportData",
    resource=lambda ctx: {
        "pilotId": ctx.params.get("pilot_id", ""),
        "sequenceId": ctx.params.get("sequence_id", ""),
    },
    secrets=lambda ctx: {"jwt": getattr(ctx.request, "sapl_token", None)},
)
async def get_export_data(request, pilot_id: str, sequence_id: str):
    return JsonResponse({"pilotId": pilot_id, "data": "export-payload"})

Test policies like you test code

SAPL is the only authorization engine with a dedicated policy testing language. Mock external data sources, emit streaming attribute changes, and assert that decisions update correctly, all declaratively. Enforce coverage thresholds as quality gates in CI/CD pipelines and generate coverage reports.

policy "permit on emergency"
permit
    action == "read" & resource == "time";
    "status".<mqtt.messages> == "emergency";

scenario "decision changes when emergency status changes"
    given
        - attribute "statusMock" "status".<mqtt.messages> emits "emergency"
    when "user" attempts "read" on "time"
    expect permit
    then
        - attribute "statusMock" emits "ok"
    expect not-applicable
    then
        - attribute "statusMock" emits "emergency"
    expect permit;

> sapl test --dir policies --testdir tests --policy-hit-ratio 100 --condition-hit-ratio 100

  permit_on_emergency.sapltest
    Permit access only during emergency status
      PASS  permit when MQTT status is emergency  13ms
      PASS  not-applicable when MQTT status is ok  1ms
      PASS  not-applicable when MQTT status is any other value  1ms
      PASS  indeterminate when MQTT PIP returns error  1ms
    Policy scope - only read action on time resource
      PASS  not-applicable for write action even during emergency  1ms
      PASS  not-applicable for delete action even during emergency  1ms
      PASS  not-applicable for read on different resource  1ms
    Streaming - decision changes dynamically with MQTT status
      PASS  permit then not-applicable as status changes from emergency to ok  1ms
      PASS  not-applicable then permit as status changes from ok to emergency  1ms
      PASS  alternating permit and not-applicable with multiple status changes  1ms

Tests:  10 passed, 10 total
Time:   27ms
Coverage:
  Policy Hit Ratio    100.00% >= 100.00%  PASS
  Condition Hit Ratio 100.00% >= 100.00%  PASS

Scenarios

Step-by-step guides for common authorization patterns, each with working code and runnable demos.

View all scenarios

Ready to evaluate SAPL?

Professional support, consulting, and training available from FTK in Dortmund, Germany. We help you plan your authorization architecture, integrate SAPL into your stack, and train your team.

Opens your email client. No data is collected or processed by this website.

European open source

SAPL originated in European research and is built around transparency, privacy, and digital independence. It is deployed in production across European research and industry projects protecting critical infrastructure and sensitive personal data. Open source, self-hosted, no vendor lock-in.

SAPL has received funding from the European Union's Horizon 2020 research and innovation programme under Grant Agreement No. 957852 (VPP4Islands) and from the European Union's Horizon Europe programme under Grant Agreement No. 101080923 (SMILE). The views expressed are those of the authors and do not necessarily reflect those of the European Commission.