Paper defines checks between a policy allow and execution admission
Original title: Beyond Policy Engines: Binding-Complete Execution Admission
An offline review of 72 OPA and Cedar scenarios kept historical failures and did not rerun the engines.
The paper argues that a policy engine ALLOW does not prove every governance source participated, that context was bound exactly, or that execution should be admitted. It defines the Binding-Complete Execution Admission Contract and a conditionally engine-agnostic design that separates governance resolution, policy evaluation, independent admission verification, and execution mediation. An offline review examined 72 OPA/Cedar scenarios and 144 strict case-engine records without rerunning the native executables. The authors say the evidence is bounded and does not establish execution safety.
Unconfirmed: The offline review did not rerun the original OPA or Cedar executables, so current engine behavior was not rechecked.
- The archive contains 120 native-invoked and 24 pre-native strict records.
- Eight additional permissive controls sit outside the strict denominator.
- An Execution Boundary Language authoring syntax is optional.
- Historical failures and unresolved implementation defects were retained.
From the original article
1 min read at arxiv.orgPolicy engines determine whether evaluated policies permit a request, but a correct ALLOW decision does not establish complete governance-source participation, exact context binding, or sufficient grounds for execution admission. This paper examines the gap between policy evaluation and execution admission.
By Lin Wang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.