Introduction

Verdict is a language and runtime for authorization that decouples access control logic from your application code.

Instead of scattering permission checks and query loops across request handlers, you define declarative rules in a policy, supply the relevant relationships and attributes as facts, and ask Verdict for a decision when your application needs to enforce access.

Write rules

Rules define your access control logic declaratively inside a central .vd policy:

// Declare an expected fact shape
declare is_owner(User, Document);

// Allow a user to read a document if they own it
allow(user: User, "read", document: Document) if
  is_owner(user, document);

Your policy brings disparate rules from across your product into one readable file where you can test and evolve them independently of your application code.

Supply facts

Facts are simple statements that represent the slice of your application data that affects access, such as ownership, team membership, or resource state.

In .vd notation, a fact looks like this:

// User alice is the owner of the handbook document
is_owner(User:alice, Document:handbook);

Facts use your product’s own domain vocabulary. Depending on how you run Verdict, your backend can write facts to Verdict Server or map them directly from your Postgres database:

// Writing a fact to Verdict Server
await client.insertFact(["is_owner", identity("User", "alice"), identity("Document", "handbook")]);

Ask for a decision

When a user requests data or performs an action, your application calls authorize to check whether they are allowed:

const aliceAllowed = await client.authorize(
  identity("User", "alice"),
  "read",
  identity("Document", "handbook"),
);
// aliceAllowed = true, because is_owner(User:alice, Document:handbook)

const bobAllowed = await client.authorize(
  identity("User", "bob"),
  "read",
  identity("Document", "handbook"),
);
// bobAllowed = false, because there is no is_owner(User:bob, Document:handbook)

Verdict evaluates matching allow rules against your facts and returns a boolean answer (true or false) so your handler can proceed or return a permission-denied error.

Components and runtimes

Verdict separates the core policy language and evaluation engine from how you deploy it:

Component	Description
Language	Declarative .vd language for rules, facts, and inline policy tests.
Engine	Deductive compiler and evaluation engine that turns rules into SQL plans.
CLI	Command-line tools for formatting, validating, testing, and publishing .vd.
Verdict Server	Standalone authorization service with an embedded fact store and RPC/REST API
Verdict Postgres	Run Verdict authorization queries directly against your Postgres database.
Client	SDK for updating facts and requesting decisions from Verdict Server.

Get started

Follow the Quickstart to run Verdict locally and test your first access policy, or start with Policy Fundamentals to learn the .vd language.