WEBVTT

1
00:00:00.180 --> 00:00:04.093
Can we check every case of an access policy?

2
00:00:04.093 --> 00:00:09.979
Our document-access rule requires authentication, either ownership or administrator status,

3
00:00:09.979 --> 00:00:16.620
and no suspension. We will formalize the rule, compile it, and test all sixteen input combinations.

4
00:00:16.620 --> 00:00:24.409
You will learn to trace an allow or deny result back to the stated
policy and identify the limits of this bounded example.

5
00:00:24.589 --> 00:00:31.706
Our query returns one bit: allow or deny for one specified combination of the four facts.

6
00:00:31.706 --> 00:00:36.977
For teaching and exhaustive checking, we will also materialize all sixteen answers.

7
00:00:36.977 --> 00:00:42.596
The rule does not verify identity or decide whether someone really is an administrator;

8
00:00:42.596 --> 00:00:46.543
those facts must come from a trusted surrounding system.

9
00:00:46.723 --> 00:00:52.145
Map the four facts to Var zero through Var three. Build owner OR administrator,

10
00:00:52.145 --> 00:00:57.834
AND that with authenticated, then AND the result with NOT suspended.

11
00:00:57.834 --> 00:01:04.219
The grouping follows the plain-language policy. Parentheses make the intended structure explicit.

12
00:01:04.399 --> 00:01:11.725
Compile the policy once, then materialize rows
authenticated-owner and columns administrator-suspended.

13
00:01:11.725 --> 00:01:17.646
In false-first order, the first two rows are all zero because authentication is absent.

14
00:01:17.646 --> 00:01:21.152
Only three of the sixteen complete assignments are accepted.

15
00:01:21.152 --> 00:01:25.610
We will inspect why, rather than treating the matrix as a black box.

16
00:01:25.790 --> 00:01:31.734
Take authenticated one, owner zero, administrator one, suspended zero.

17
00:01:31.734 --> 00:01:34.811
Owner OR administrator gives one.

18
00:01:34.811 --> 00:01:40.326
Authentication is present and suspension is absent, so the final result is one.

19
00:01:40.326 --> 00:01:47.094
This is row one-zero and column one-zero, or row two and column two in binary addressing.

20
00:01:47.274 --> 00:01:51.639
Keep that same administrator case, but change suspended to one.

21
00:01:51.639 --> 00:01:58.629
The first two requirements still pass, but not suspended
is now zero. The whole conjunction becomes zero.

22
00:01:58.629 --> 00:02:04.848
The highlighted cell moves one column to the right and changes from allow to deny.

23
00:02:05.028 --> 00:02:11.100
Our separate scalar oracle evaluates authenticated AND owner-or-administrator AND

24
00:02:11.100 --> 00:02:17.091
not-suspended for every four-bit assignment. Every matrix lookup matches.

25
00:02:17.091 --> 00:02:23.952
Three cases are allowed: authenticated, not suspended, and at least one of owner or administrator.

26
00:02:23.952 --> 00:02:25.960
The other thirteen are denied.

27
00:02:26.140 --> 00:02:32.177
Suppose the person is authenticated and is the owner, is not an administrator, and is suspended.

28
00:02:32.177 --> 00:02:39.143
Should the policy allow access? Use the expression
as written, not a different policy you might prefer.

29
00:02:39.143 --> 00:02:50.474
Identify which requirement decides the result.

30
00:02:50.654 --> 00:02:56.819
The not-suspended factor is zero, so the result is deny even for an authenticated owner.

31
00:02:56.819 --> 00:03:03.553
If ownership were meant to override suspension, that
would be a different policy expression requiring new tests.

32
00:03:03.553 --> 00:03:09.079
This example implements the stated rule, not a universal access-control design.

33
00:03:09.259 --> 00:03:16.492
Keep the expression, variable map, axis ordering, compiled
representation when useful, and validation results.

34
00:03:16.492 --> 00:03:22.958
This local example makes no deployment or security
claim and no benchmark claim. Across the series,

35
00:03:22.958 --> 00:03:29.494
the same habit has mattered: define the object, show
the operation, and verify the result against its meaning.