Defining Policies & Rules

In TrustBuilder, Policies and Rules control access is based on user attributes and context. A Policy contains multiple Rules, and a combination algorithm defines how these rules are evaluated to grant or deny access.

TrustBuilder uses the XACML standard (eXtensible Access Control Markup Language) for defining and enforcing access control in a consistent, structured way..

TrustBuilder uses PBAC (Policy-Based Access Control), an extension of ABAC (Attribute-Based Access Control). Unlike role-based models, PBAC evaluates dynamic data like user attributes, context (time, device, etc.), and risk scores in real-time.

Create a policy

To create a policy from TrustBuilder Admin portal:

1. Navigate to Access Management > Policies.

2. Click on + Add Policy.

3. Enter a name for your policy (without spaces) and a description.

   

4. Add one or more rules.
   Rules are evaluated in order: the first rule is checked first, then the second, and so on.

   • If the rule already exists: drag and drop it under the policy

     

   • If the rule does not yet exist, click on + Create new rule (see Create a rule).

5. Choose a combination algorithm (see Combination):

   

6. Click on Save.

"rules": ["rule_name01","rule_name02","rule_name03","rule_name04"]

Policy example

{
    "name": "secure-admin-access",
    "description": "Requires MFA and admin role for access",
    "rules": ["require_authent_aal1","only-admins","specific_userid"],
    "combination": "DENY_OVERRIDES"
}

Create a rule

To create a rule from TrustBuilder Admin portal:

1. Navigate to Access Management > Rules.

2. Click on + Add Rule.

3. Enter enter a name for your rule (in lowercase without space) and an optional description.

4. Add expression(s):

   1. Click on the + icon to add an expression.

   2. In the expression section:

      • select an attribute,

      • select an operator

      • enter a value if needed.

        

        (see Condition below)

5. Select the combining condition:

   

   • all-of → act as AND = all expressions must be met.

   • any-of → act as OR = at least one expression must be met.

6. Select the effect: "PERMIT" or "DENY" (see Effect below).

7. (optional) Define an obligation to add additional requirement before granting access:

   1. Click on Obligation options.

   2. Select an obligation type:

      • Persona → select “any persona” or specific persona(s) in the list.

      • Specific authentication level → select at least one authentication level.

      • Minimum authentication level → select an authentication level.

        (see Obligation below)

   3. Click Save to add the obligation.

8. Click on Save to create the rule.

Authentication rule in policy

For a policy to work, it must include at least one rule that allows authentication.
Without authentication, the system cannot identify the user and therefore cannot evaluate conditions based on user attributes, persona or session context.

A typical authentication rule checks whether the user has authenticated with a given assurance level (e.g., AAL1) and enforces this requirement as an obligation:

{
  "name": "require_authent_aal1",
  "effect": "PERMIT",
  "description": "Simple authentication with one factor",
  "condition": {
    "elem_match": [
      "$session.authentications",
      {
        "equals": [
          "~acr",
          "AAL1"
        ]
      }
    ]
  },
  "obligation": {
    "requires_acr": [
      "AAL1"
    ]
  }
}

• The condition checks whether the session includes an authentication with AAL1 level.

• The obligation ensures the user must authenticate using AAL1.