Skip to content

Latest commit

 

History

History
executable file
·
46 lines (32 loc) · 1.96 KB

PolicyObject.md

File metadata and controls

executable file
·
46 lines (32 loc) · 1.96 KB

Policy Object

Summary

The Policy Object is defined by the client at the time of the payload's encryption. It contains the information required by the KAS to make an access decision during decryption. The policyObject is stored in the manifest.json for a TDF, and sent to the KAS along with an entity object so that the KAS may make an access decision.

The KAS uses the Policy Object to make its decision to grant access to the TDF payload. The entity or user requesting access must be in the dissem (dissemination) list AND must possess entity attributes (as returned by the EAS) that satisfy all the data Attributes.

Version

The current schema version is 1.0.0.

Example

{
"uuid": "1111-2222-33333-44444-abddef-timestamp",
"body": {
    "dataAttributes": [<Attribute Object>],
    "dissem": ["[email protected]"]
  },
"schemaVersion:": "x.y.z"
}

uuid

Parameter Type Description
uuid String A unique UUID for the TDF's policy.

body

Parameter Type Description Required?
body Object Object which contains information about the policy required for the KAS to make an access decision. Yes
body.dataAttributes Array An array of attributes a user would need to request access to key. In other words, attributes a user must possess to be able to decrypt the content. An Attribute Object is defined in defined in its own section: Attribute Object. Yes
body.dissem Array An array of unique userIds. It's used to explicitly list users/entities that should be given access to the payload, and should be given as an id used to authenticate the user against the EAS. Yes
schemaVersion String Version number of the PolicyObject schema. No

schemaVersion

Parameter Type Description Required?
schemaVersion String Version number of the PolicyObject schema. No