Most Policy Decision Points return a bare allow/deny. This one maps the AuthZEN 1.0 Authorization API request shape ({subject, action, resource, context}) to a mandate gate, and returns the standard {decision, context} response with an OCG execution receipt carried in context. Any relying party can take that receipt and independently replay the decision.
The PDP accepts the standard AuthZEN Authorization API evaluation request and returns the standard response shape. context is optional, per the spec: a plain request decides from the server-side policy, and an OCG decision gate can be supplied in context when you want to bind the decision to one. Nothing about the wire contract changes; the receipt rides inside the response's existing context field.
| AuthZEN field | Maps to | Notes |
|---|---|---|
subject | mandate principal | The identity or agent requesting authorization. |
action | mandate scope/verb | The action the subject wants to perform. |
resource | mandate target | The resource the action would apply to. |
context (request) | mandate parameters | Optional. When it carries an OCG decision gate, the decision is bound to that gate; otherwise the server-side policy decides. |
decision (response) | allow/deny | Standard AuthZEN boolean decision, unchanged. |
context (response) | OCG execution receipt | The differentiator: an execution_hash-referenced receipt a relying party can replay independently of this PDP. |
POST /authzen/evaluation
{
subject: { type: "agent", id: "agent-example-001" },
action: { name: "can_execute_payment" },
resource: { type: "mandate", id: "mandate-example-001" }
}
// response
{
decision: true,
context: { ocg_receipt: { execution_hash: "sha256:…", node: "compile_work_mandate" } }
}