apache / apache/casbin

[feature] support the new "a" type policies (aka LLM AI policy)

Open
#1,692 0 comments 1 reaction 2 assignees Claimed by @hsluoyz View on GitHub
enhancement
Dominant language
Go
Stars
20.4k
Forks
1.8k
Avg merge
5d 11h
Merged PRs (30d)
2

Description

see: https://editor.casbin.org/#6W5HP2HEM

need to support the new "a" type policy (means AI LLM policy, can be "a", "a2", "a3" like p and g policy), like:

```
a, "if the request object contains anything like credential/secret leak, then deny"
```

so Casbin will call the LLM API (use the new Explain API in: https://github.com/casbin/casbin/commit/0fe9505818b12d66739b8e86887539b3ce57942a) to determine the "a" policy: "if the request object contains anything like credential/secret leak, then deny".

# Casbin Policy Configuration

## Model
```
[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = ipMatch(r.sub, p.sub) && r.obj == p.obj && r.act == p.act
```

## Policy
```
p, 192.168.2.0/24, data1, read
p, 10.0.0.0/16, data2, write
a, "allow US residential IPs to read data1" # "residential" means not cloud IPs
a, "allow global cloud IPs to write data2"
```

## Request
```
192.168.2.1, data1, read
10.0.2.3, data2, write
```

## Enforcement Result
```
(empty)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.