Policy Document
A Policy Document is a first-class document carrying authorisation rules for the Documentation Index. Rules are RDF triples; each names a subject or role, an action, a target pattern, and optionally an ABAC condition expressed as a SPARQL ASK clause.
Why policy-as-documents
Policies are versioned, transaction-validated, queryable, and navigable in the same way as every other document. Changing policy is a publish; rolling back policy is resolving an older Version. Authz decisions are grounded in data the organisation can audit, not in configuration files the registry owns opaquely.
Gate-1 evaluation
For every assertion or retraction in an incoming transaction, the authz gate searches the current set of Policy Documents for a matching allow rule. Missing match → the transaction declines with a gate-1 reason identifying the rule gap.
Queries
Query-time authz rewrites the incoming SPARQL to AND-in an ABAC filter derived from the requester's attributes and the current policy set. Unauthorised bindings are pruned server-side; queries the rewriter cannot reason about fail closed.
Bootstrap
The very first Policy Document (core/policies/bootstrap) is published by an operator-configured bootstrap role that exists before any in-graph policy to enforce authz against. After bootstrap, all further policy changes flow through the normal pipeline.