Glossary
Policy Decision Point (PDP)
A policy decision point takes a request, the identity of the requester, and whatever supporting evidence the policy requires, and evaluates them against a set of rules to produce a decision — typically allow or deny. It is deliberately separated from the policy enforcement point that carries the decision out, and from the resource the decision protects.
This separation is what makes a decision reviewable. If the decision point is a distinct component with its own inputs and outputs, its behavior can be tested independently of the system it protects: the same request, replayed against the same policy version, should produce the same decision every time. A decision point whose logic is scattered across the application it protects is much harder to audit, because there is no single place to point to and say 'this is what decided.'