ABAC Policies

ABAC (attribute-based access control) policies declare rules over properties of the user, the resource and the request that the policy engine evaluates at check time. Each policy specifies an effect (allow or deny), the action and resourceType it applies to, and a tree of conditions on subject, resource, and environment attributes. Policies are combined using the deny-overrides algorithm — any matching deny blocks access even if allow policies also match — and the default is deny when no policy matches.

Use this reference to manage policies over the API.

GET    /orgs/{orgId}/api/v1/abac/policies
POST   /orgs/{orgId}/api/v1/abac/policies
GET    /orgs/{orgId}/api/v1/abac/policies/{policyId}
PUT    /orgs/{orgId}/api/v1/abac/policies/{policyId}
DELETE /orgs/{orgId}/api/v1/abac/policies/{policyId}

The Policy Object

Policy Object

{
  "id": "01JF3KPOL...",
  "name": "finance-approval",
  "description": "Finance team members can approve invoices",
  "effect": "allow",
  "action": "approve",
  "resourceType": "invoice",
  "conditions": {
    "operator": "AND",
    "conditions": [
      {
        "subject": "user.department",
        "operator": "equals",
        "value": "finance"
      },
      {
        "subject": "resource.amount",
        "operator": "lte",
        "value": 50000
      }
    ]
  },
  "isActive": true,
  "priority": 100,
  "createdAt": "2026-01-15T10:30:00Z"
}

A policy targets exactly one action (a string; use "*" to match all actions) and one resourceType. The conditions field is a tree: the root is a group with operator (AND or OR) and a conditions array. Each leaf condition is { "subject", "operator", "value" }, where subject is an attribute path such as user.department, resource.amount, or environment.hour. Groups can be nested arbitrarily. Comparisons are always against a literal value — there is no attribute-to-attribute comparison.

List Policies

List ABAC Policies

curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/policies" \
  -H "Authorization: ApiKey lmk_abc123"

Create Policy

Create a Policy

curl -X POST https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/policies \
  -H "Authorization: ApiKey lmk_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "finance-approval",
    "description": "Finance team can approve invoices up to 50k",
    "effect": "allow",
    "action": "approve",
    "resourceType": "invoice",
    "conditions": {
      "operator": "AND",
      "conditions": [
        {
          "subject": "user.department",
          "operator": "equals",
          "value": "finance"
        },
        {
          "subject": "resource.amount",
          "operator": "lte",
          "value": 50000
        }
      ]
    },
    "isActive": true,
    "priority": 100
  }'

Required fields on create are name, resourceType, action, effect, and conditions. The root of conditions must be a group with operator set to AND or OR.

Condition Operators

Operator	Description
equals	Exact match
not_equals	Not equal
in	Value is in the provided array
not_in	Value is not in the array
gt	Greater than
gte	Greater than or equal
lt	Less than
lte	Less than or equal
contains	String or array contains value
not_contains	String or array does not contain value
matches	Value matches the regular expression in value
exists	Attribute is present
not_exists	Attribute is absent

Regex constraints for matches

matches patterns must be a complete, anchored regular expression and may only use /, #, or ~ as delimiters (e.g. "value": "/^.+@company\\.com$/"). Patterns that fail this guard never match.

AI Policy Authoring

Describe a policy in plain English and let LumoAuth's AI draft the policy definition. The generated JSON is previewed so you can review before creating.

GET  /orgs/{orgId}/portal/policies/author   # the authoring page
POST /orgs/{orgId}/portal/policies/parse     # parse natural language into a draft policy
POST /orgs/{orgId}/portal/policies/create    # persist the reviewed policy

This feature is available when the platform has an AI provider configured.

Activate / Deactivate a Policy

Toggle a policy's isActive flag without editing it. Inactive policies are skipped during evaluation.

Toggle a Policy

curl -X POST "https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/policies/01JF3KPOL.../toggle" \
  -H "Authorization: ApiKey lmk_abc123"

System policies are protected

Built-in (isSystem) policies cannot be modified or deleted; those requests return 403 with System policies cannot be modified.

Related

• Attributes — attribute definitions referenced by policy conditions.
• ABAC overview — evaluation semantics and worked examples.