Free lab · Fine-grained authorization · ALFA / PBAC / ABAC
ALFA Playground — Free Fine-Grained Authorization Lab
What if you actually tested an authorization policy?
Write a policy, test it against concrete scenarios and discover how an authorization decision changes with context.
An organization may know exactly who holds a permission without being able to determine whether using it is legitimate in a particular situation. Fine-grained authorization addresses this difficulty by evaluating an action, a resource and a context against an explicit policy.
With ALFA Playground, you can experiment with this logic without installing an authorization engine. Ariovis helps you understand these mechanisms, from your first scenarios to their role in an IAM architecture.
New tab · Registration with a work email address required
Free tool provided by Axiomatics · Work email registration required · No installation
ALFA Playground is developed and operated by Axiomatics, an Ariovis technology partner. Ariovis provides an educational journey to understand its role in an IAM architecture.
The question is no longer simply who holds a permission.
A user may hold a legitimate role without being authorized to view every document, approve every transaction or use every resource accessible through their application.
Dynamic authorization complements entitlement governance by considering the resource's characteristics, the requested action and the request context. With an explicit policy, these conditions can be understood, tested and maintained without being scattered across every application.
- Subject
- The identity requesting access, with its roles and attributes.
- Action
- The requested operation, such as viewing, modifying, approving or exporting.
- Resource
- The document, record, API or business object concerned.
- Environment
- The context available at decision time, such as location, time or risk level.
- Subject + Action + Resource + Environment
- Authorization policy
- Decision
Change an attribute. See how the decision changes.
Authorization decisions do not depend solely on the requester's identity. A resource's confidentiality level, location or delegation conditions can also change the outcome.
This introductory Ariovis simulator illustrates how a policy works with fictional data. To write and compile a real ALFA policy, then use Axiomatics' official playground.
Ariovis educational simulation — this component does not execute the ALFA engine
Request attributes
Action: View
Educational policy
Allow viewing if role = Manager, or role = Employee and classification = Public. Otherwise deny.
Evaluation · Decision
Denied
- The requester may view public documents, but this resource is confidential. The policy requires a higher authorization level for this classification.
Now move on to a real ALFA policy
These scenarios illustrate decision logic. The Axiomatics playground takes you to the next step: writing the policy, compiling it, building a request and evaluating its result.
New tab · Registration with a work email address required
Four scenarios for experimenting with authorization policies
Axiomatics provides several example policies directly in its playground. They introduce simple rules, then situations in which combining conditions or handling an exception becomes decisive.
01
Consultant location access
Consultant Location Access
The scenario checks whether the consultant's location matches the requested resource's location. Changing an attribute shows how context influences the result.
02
Document classification
Document Sensitivity Access
A policy distinguishes public and confidential documents and considers the requester's profile. The exercise shows how to combine identity and resource attributes.
03
Payment approval
Payment Approval Workflow
The scenario first denies blocked payments, then evaluates the conditions for owners and approvers. It introduces rule priority within a policy.
04
Emergency access to a health record
Healthcare Break-glass Access
The scenario allows access for assigned clinicians and provides a separate rule for certain emergencies. It explores explicit exceptions without confusing them with permanent access.
New tab · Registration with a work email address required
From the first rule to the first decision
The playground follows the main stages of designing an authorization policy without deploying infrastructure. The objective is to make explicit what the application should allow, then test that rule against different requests.
01
Create your access
Register for the Axiomatics service using a work email address.
02
Choose a policy
Start from a built-in example or write your own policy.
03
Compile
Compilation checks the policy's validity.
04
Build a request
Provide the necessary subject, action, resource and context attributes.
05
Evaluate
Run the request to observe the returned decision.
06
Visualize
Use the graphical view to examine the policy's structure.
Testing a policy does not yet secure an application.
The playground helps you understand, write and test policies on small scenarios. On its own, it does not implement the mechanisms needed to effectively control the actions of an application, API or AI agent in an information system.
A production architecture also needs reliable attribute data, policy governance, a decision engine suited to operational constraints and enforcement points that apply the decisions. Ariovis supports this continuity between the business rule, the decision and its enforcement in fine-grained authorization projects.
- Application / API / Agent
- PEP
- PDP / Policies
- Decision
- PEP
- Resource
PIP — Attribute sources → PDP
Illustrative production architecture — the playground does not implement these integrations.
A good authorization policy should be understandable before it is executed.
Roles remain an excellent way to structure an organization's entitlements. They connect business responsibilities, access requests, approvals and certification campaigns.
But when a decision depends on a specific record, business relationship, classification, action or execution context, multiplying roles does not necessarily solve the problem. It then becomes useful to formalize that decision in an explicit policy and evaluate it when the action is requested.
ALFA makes this policy more readable than its XML expression in XACML. This readability facilitates discussion among architects, developers, business owners and security teams. It does not remove the need to govern attributes, test rules or secure the applications that must enforce the decisions.
Would you like to go further with your authorization architecture?
Assess your needs
Not every application needs an externalized decision engine. Our diagnostic helps distinguish needs addressed by role models, IAM governance or dynamic authorization.
French-language diagnostic
Understand our technology choice
Our Axiomatics partnership is grounded in a view of authorization that complements identity governance and authentication. Discover why we chose this technology and the architectures in which it adds value.
Build a real architecture
Ariovis supports business decision qualification, policy design, decision and enforcement point integration, testing and solution operations.
Practical information and FAQ
Is ALFA Playground free?
Yes. Axiomatics provides this discovery and experimentation environment for free, with no installation. However, it requires registration with a work email address.
Is ALFA the same as PBAC?
No. PBAC describes an approach in which decisions are governed by policies, while ALFA is a language for expressing authorization policies. Models such as ABAC can be expressed within this policy-based logic.
Do I need to know XACML to get started?
No. ALFA offers a readable way to express policies that can be compiled into XACML. Axiomatics' examples introduce authorization mechanisms progressively without starting with XML syntax.
Can I use the playground in production?
No, that is not its purpose. The playground is for learning and testing limited scenarios; a production architecture requires application integrations, attribute sources, operations and decision enforcement points.
What happens to my policies and data?
According to Axiomatics, policy data stays in the browser by default during use. Reloading or signing out may erase your work, and an optional contribution feature allows Axiomatics to retain some anonymized policy content under its terms. Consult the official terms and use fictional data for your experiments.