Authorization policy evaluation

A method performed by one or more electronic devices, the method comprising:

• receiving an authorization request;
• identifying a set of authorization policies, wherein each authorization policy in the set of the authorization policies comprises:
• (a) an effect;
• (b) an authorization policy head that selects principals, actions, or resources to which the authorization policy applies;
• and
• (c) one or more optional conditional clauses that further refine the circumstances under which the authorization policy applies;
• pruning at least one authorization policy of the set of authorization policies, from evaluation against the authorization request based on the authorization policy head of the at least one authorization policy;
• evaluating a subset of the set of authorization policies against the authorization request;
• and
• allowing or denying the authorization request based on evaluation of the subset of authorization policies.

A system comprising:

• a first set of one or more electronic devices to implement an authorization policy evaluation service, the authorization policy evaluation service comprising instructions which when executed cause the authorization policy evaluation service to perform:
• receiving an authorization request;
• identifying a set of authorization policies, wherein each authorization policy in the set of the authorization policies comprises:
• (a) an effect;
• (b) an authorization policy head that selects principals, actions, or resources to which the authorization policy applies;
• and
• (c) one or more optional conditional clauses that further refine the circumstances under which the authorization policy applies;
• pruning at least one authorization policy of the set of authorization policies, from evaluation against the authorization request based on the authorization policy head of the at least one authorization policy;
• evaluating a subset of the set of authorization policies against the authorization request;
• and
• allowing or denying the authorization request based on evaluation of the subset of authorization policies.