Declarative Policy Engine

6. Declarative Policy Engine

The Policy Engine evaluates declarative rule sets against live DIDs and attached credentials.

Endpoint & Payload

POST /v1/policies/evaluate

{
  "did": "did:web:identity.foundation",
  "policy": {
    "name": "Enterprise Production Ingress Policy",
    "rules": {
      "didResolution": "required",
      "allowedMethods": ["web", "webvh"],
      "allowedCurves": ["Ed25519", "P-256"],
      "minKeyBits": 256,
      "requireKeyRelationship": "assertionMethod",
      "domainBinding": "required",
      "tlsMinDaysRemaining": 14,
      "verifiableHistory": "required",
      "maxCacheAgeSeconds": 600,
      "credentialStatus": "active",
      "credentialIssuerMustBeSubject": true
    }
  }
}

---

Policy Syntax & Supported Rules Directory

Rule Identifier	Type	Criteria for PASS
didResolution	"required"	DID resolves cleanly and deactivated is false.
allowedMethods	string[]	Method prefix is included in the list (e.g. ["web", "webvh"]).
allowedCurves	string[]	All active keys use listed curves (Ed25519, P-256, secp256k1).
allowedKeySuites	string[]	Verification method type strings are in the allowed list.
minKeyBits	integer	Weakest valid signing key meets or exceeds bit length.
requireKeyRelationship	string	At least one valid key is bound to the named relationship.
domainBinding	"required"	DIF domain linkage status is VERIFIED.
tlsMinDaysRemaining	integer	Leaf TLS certificate has $\ge N$ days of validity remaining.
verifiableHistory	"required"	Identity publishes a verified SCID log (did:webvh).
maxCacheAgeSeconds	integer	Resolution observation was observed within the last $N$ seconds.
credentialStatus	"active"	Attached credential verifies with status VALID.
credentialIssuerMustBeSubject	boolean	Attached credential issuer DID matches the evaluated subject DID.

Note: Missing evidence causes rules to evaluate to INDETERMINATE. A rule never defaults to PASS.

---

Evaluating Policies via API & SDKs

TypeScript SDK Policy Evaluation

import { DidisClient } from "@didis/client";

const didis = new DidisClient();

const result = await didis.evaluatePolicy("did:web:identity.foundation", {
  name: "API Ingress Policy",
  rules: {
    didResolution: "required",
    allowedMethods: ["web", "webvh"],
    allowedCurves: ["Ed25519", "P-256"],
    domainBinding: "required",
    tlsMinDaysRemaining: 7
  }
});

console.log(`Policy Evaluation: ${result.evaluation.status}`); // PASS / FAIL / INDETERMINATE
for (const rule of result.evaluation.evaluations) {
  console.log(`  [${rule.status}] ${rule.rule}: ${rule.message}`);
}

Python SDK Policy Evaluation

from didis import DidisClient

with DidisClient() as client:
    res = client.evaluate_policy(
        did="did:web:identity.foundation",
        policy={
            "name": "API Ingress Policy",
            "rules": {
                "didResolution": "required",
                "allowedMethods": ["web", "webvh"],
                "allowedCurves": ["Ed25519", "P-256"],
                "domainBinding": "required",
            }
        }
    )
    print(f"Policy Status: {res['evaluation']['status']}")

---