Entitlement Service

The PDP is the brain of the entitlement service. It evaluates incoming authorization requests against a set of defined policies and real-time attributes to issue a Permit or Deny decision.

• Contextual Evaluation: Considers user identity, resource type, action, and environmental context (time, location, device posture).
• Policy Language: Interprets rules written in standards like XACML or Rego (OPA).
• Stateless Operation: Designed for horizontal scaling, it relies on external Policy Information Points (PIPs) for attribute data.

The PEP is the gatekeeper, typically implemented as an API Gateway or interceptor. It intercepts every request to a protected resource and enforces the PDP's decision.

• Integration Point: The PEP calls the PDP, passing the subject, resource, and action.
• Enforcement Action: On a Deny, it returns an HTTP 403 Forbidden; on a Permit, it allows the request to proceed.
• Obligation Fulfillment: Can execute post-decision instructions from the PDP, such as redacting sensitive fields or starting a logging session.

Modern entitlement services use ABAC instead of static roles. Access is granted based on a combination of attributes, enabling dynamic, fine-grained licensing enforcement.

• Subject Attributes: User department, clearance level, subscription tier.
• Resource Attributes: Content type, sensitivity classification, licensing cost center.
• Action Attributes: read, download, use_for_training.
• Environmental Attributes: Time of day, network location, authentication strength. This allows a single rule like: Allow download if user.tier is 'premium' AND resource.license is 'commercial'.

The service maintains a strict lifecycle for each granted entitlement, modeled as a finite state machine. This prevents unauthorized usage of expired or revoked licenses.

• State Transitions: Active → Suspended (non-payment) → Revoked (breach) → Expired (time-bound).
• Event-Driven: Transitions are triggered by external events from a billing system or a Revocation Endpoint.
• Atomic Enforcement: The PDP checks the current state of the license at runtime. A request tied to a Revoked license is denied immediately, ensuring compliance with contractual terms.

Entitlement services issue and validate JSON Web Tokens (JWT) containing precise, limited scopes. This implements the principle of least privilege for API consumers.

• Scope Encoding: A JWT claim might be "scopes": ["corpus:read", "model:train"].
• Cryptographic Verification: The PEP validates the token's signature using a public key without a network call to the PDP for every request, reducing latency.
• Fine-Grained Permissions: Scopes map directly to specific API endpoints and operations, preventing a token with read access from being used for delete operations.

The entitlement service integrates with a Token Bucket Algorithm to enforce usage limits defined in a licensing agreement, preventing abuse and ensuring fair resource allocation.

• Token Bucket: A conceptual bucket fills with tokens at a fixed rate. Each API call consumes a token. A burst of traffic is allowed until the bucket is empty.
• Quota Tracking: The service tracks data volume ingested or number of training runs against a Monetization Tier's limit.
• Hard Enforcement: When a quota is exhausted, the PDP issues a Deny with a 429 Too Many Requests status, protecting backend resources and enforcing the commercial agreement.