# US 12,118,102 B1 · Partial policy evaluation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,102 B1 - Document ID: US12118102B1 - Status: Granted - Kind: B1 - Application number: 18/239,714 - Filed: 2023-08-29 - Granted: 2024-10-15 - Earliest claimed: 2018-08-24 - Assignees: Styra, Inc. - Applicants: Styra, Inc. - Inventors: Torin Sandall; Timothy L. Hinrichs; Teemu Koponen - Web page: https://patentgrep.com/patent/US12118102B1 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/629: {to features or functions of an application} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Some embodiments provide a method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application. Based on a first set of parameters available before receiving the API call, the method evaluates only a portion of the policy to produce a partially evaluated policy. The method stores the partially evaluated policy in a cache. The method then receives an API call to authorize, and determines whether the API call should be authorized by fully evaluating the policy, using the partially evaluated policy retrieved from the cache first storage, and a second set of parameters associated with the API call. The method responds to the API call with a policy decision based on the fully evaluated authorization policy. ## Claims ### Claim 1 A method for evaluating a policy for authorizing an API (Application Programming Interface) call to an application, the method comprising: based on a first set of parameters available before receiving the API call, evaluating only a first portion of the policy to produce a partially evaluated policy; storing the partially evaluated policy in a cache first storage; receiving an API call to authorize; fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache first storage and (2) a second portion of the policy not previously evaluated to produce the partially evaluated policy; and responding to the API call with a policy decision based on the full evaluation of the policy. ### Claim 2 (depends on 1) The method of claim 1, wherein the first set of parameters is associated with the API call. ### Claim 3 (depends on 1) The method of claim 1, wherein the second portion is evaluated based on a second set of parameters identified after receiving the API call. ### Claim 4 (depends on 3) The method of claim 3, wherein the second set of parameters includes at least one parameter received with the API call. ### Claim 5 (depends on 3) The method of claim 3, wherein the second set of parameters includes at least one parameter retrieved from a second storage after receiving the API call. ### Claim 6 (depends on 5) The method of claim 5, wherein the at least one parameter is retrieved from the second storage based on a parameter received with the API call. ### Claim 7 (depends on 5) The method of claim 5, wherein the at least one parameter is retrieved with the partially evaluated policy from the second storage. ### Claim 8 (depends on 3) The method of claim 3, wherein the API call is a first API call, the method further comprising: receiving a second API call to authorize; fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache storage and (2) a third set of parameters associated with the second API call; and responding to the second API call based on the full evaluation of the policy for the second API call. ### Claim 9 (depends on 1) The method of claim 1, wherein the policy is a role-based access control (RBAC) policy. ### Claim 10 (depends on 1) The method of claim 1, wherein the first portion of the policy comprises one or more computationally expensive operations. ### Claim 11 A non-transitory machine readable medium storing a program executing on at least one processing unit of a computer, the program for evaluating a policy for authorizing an API (Application Programming Interface) call to an application, the program comprising sets of instructions for: based on a first set of parameters available before receiving the API call, evaluating only a first portion of the policy to produce a partially evaluated policy; storing the partially evaluated policy in a cache first storage; receiving an API call to authorize; fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache first storage and (2) a second portion of the policy not previously evaluated to produce the partially evaluated policy; and responding to the API call with a policy decision based on the full evaluation of the policy. ### Claim 12 (depends on 11) The non-transitory machine readable medium of claim 11, wherein the first set of parameters is associated with the API call. ### Claim 13 (depends on 11) The non-transitory machine readable medium of claim 11, wherein the second portion is evaluated based on a second set of parameters identified after receiving the API call. ### Claim 14 (depends on 13) The non-transitory machine readable medium of claim 13, wherein the second set of parameters includes at least one parameter received with the API call. ### Claim 15 (depends on 13) The non-transitory machine readable medium of claim 13, wherein the second set of parameters includes at least one parameter retrieved from a second storage after receiving the API call. ### Claim 16 (depends on 15) The non-transitory machine readable medium of claim 15, wherein the at least one parameter is retrieved from the second storage based on a parameter received with the API call. ### Claim 17 (depends on 15) The non-transitory machine readable medium of claim 15, wherein the at least one parameter is retrieved with the partially evaluated policy from the second storage. ### Claim 18 (depends on 13) The non-transitory machine readable medium of claim 13, wherein the API call is a first API call, the program further comprising sets of instructions for: receiving a second API call to authorize; fully evaluating the policy using (1) the partially evaluated policy retrieved from the cache storage and (2) a third set of parameters associated with the second API call; and responding to the second API call based on the full evaluation of the policy for the second API call. ### Claim 19 (depends on 11) The non-transitory machine readable medium of claim 11, wherein the policy is a role-based access control (RBAC) policy. ### Claim 20 (depends on 11) The non-transitory machine readable medium of claim 11, wherein the first portion of the policy comprises one or more computationally expensive operations.