Policy

The optional post-RBAC hook. 2a defines this seam and ships NO implementation and NO registration — nothing consults a policy unless a host wires one. It is the extension point that lets attribute-based rules (ABAC) land later with no breaking change; the intended composition is deny-override.

abstract public function allows(Milpa\Auth\Actor $actor, Milpa\Auth\Permission $permission, Milpa\Auth\PermissionContext $context): Milpa\Auth\PolicyDecision

Check if an actor is allowed to perform an action on a resource in the given context.

Parameters