@cson-sec/abac-rag-policy

Generic ABAC decisions and query-filter helpers. Apache-2.0, Copyright 2026 Duong Cong Son (cson).

import { AbacRagPolicy } from '@cson-sec/abac-rag-policy';
const policy = new AbacRagPolicy({ allowDataOwnerOverride: false });
const result = policy.evaluate(subject, resource);
const filter = policy.buildSqlFilter(subject);

Populate SubjectProfile and ResourceMetadata from trusted, validated host data. Classification is 0-4. Configure role restrictions, data-owner override and break-glass behavior explicitly for your application. Permission hashes represent subject attributes; they are not document ACL fingerprints.

buildSqlFilter returns an AND condition tree, not executable SQL. Serialize with parameter binding in your database adapter. It is a conservative helper and does not completely express the point-decision visibility/allowed-users/data-owner logic. The host must supply any missing pre-retrieval constraints and run evaluate on each candidate. A returned filter must not be treated as complete authorization. Validate profiles/resources before using the policy engine.

Build and test from the workspace: pnpm --filter @cson-sec/abac-rag-policy build and pnpm --filter @cson-sec/abac-rag-policy test. Tests use synthetic profiles/resources; no database or external API is required.

Install in another application

After version 0.1.1 is publicly available on npm:

npm install @cson-sec/[email protected]

ESM import and CommonJS require use the package name; do not import internal src or dist paths. See the workspace consumer guide for an example and offline tarball installation. This npm command is for consumer applications; use pnpm in the source monorepo to resolve workspace:*.