Policy Decision Point (PDP)
The authorization engine that evaluates access requests against policies and returns allow/deny decisions. The PDP is the "brain" — it owns the rules and logic.
A Policy Decision Point (PDP) is the authorization engine that evaluates access requests against policies and returns allow/deny decisions. The PDP is the "brain" of an authorization system — it owns the rules, the logic, and the data needed to answer the question: "is this subject allowed to perform this action on this resource?"
PDP vs PEP
The PDP is one half of the XACML reference architecture. Its counterpart is the Policy Enforcement Point (PEP) — thin code in your application that intercepts requests and asks the PDP for a decision. The PEP enforces decisions but does not own policy logic. This separation means:
- Application code stays simple — one line to ask "is this allowed?"
- Policy changes don't require code deploys
- Multiple services can share one PDP for consistent enforcement
Performance requirements
Because the PDP runs on the critical path of every request, its p99 latency is a floor under your entire API's p99. A well-designed PDP returns decisions in single-digit milliseconds — colocated with the application, using denormalized data and request-scoped caching.
WardenAuth is an externalized PDP available via REST API and SDKs. Try it free.
Related terms
Authorization that evaluates permissions at the individual resource or action level, rather than broadly by user type or role.
Thin code in your application that intercepts requests and asks the PDP "is this allowed?" The PEP enforces decisions but does not own policy logic.
Architecture pattern where authorization logic is moved from application code to a dedicated service (PDP). Your app asks for decisions rather than embedding permission checks.