Authorization

Open Decision Query

An Open Decision Query is an authorization request that asks what is allowed rather than only asking for a binary yes or no.

Definition

An Open Decision Query is a decision pattern in which the caller asks broad authorization questions such as what a user can do, who can access a resource, or which records are visible in a given context. It differs from binary permit-or-deny checks by supporting exploratory, contextual, or reverse authorization use cases.

Why it matters

Open queries enable advanced use cases like user entitlement reviews, access certification, and dynamic UI adaptation based on permissions.

The Ariovis perspective

Authorization policies should be separated from application code when consistency, auditability or scale require it. Enforcement remains close to the resource while the decision is governed independently.

Common pitfalls

  • Open queries can be computationally expensive and may expose more information than intended if not properly constrained.

These concepts matter most inside a real project.

The first conversation helps establish your context, the systems involved and the next useful decision.