# Policy-language evidence memo

Research date: 2026-09-16

## Core conclusion

JSON and YAML are serialization formats, not policy semantics. They are sufficient as a policy surface when a platform exposes a small, closed, schema-validated rule model. A dedicated DSL or embedded expression language is warranted when authors need reusable derivations, nested logic, quantification, joins, graph traversal, explicit combining semantics, obligations, static analysis, partial evaluation, or independent policy lifecycle management.

## General technologies

- OPA/Rego: general declarative policy over structured data; tests, bundles, explanations, and partial evaluation. https://www.openpolicyagent.org/docs/latest/policy-language/
- Cedar: schema-aware authorization over principal/action/resource/context; default deny and forbid-overrides-permit. https://docs.cedarpolicy.com/
- CEL: bounded embedded expression language; the host owns combination, lifecycle, and enforcement. https://cel.dev/
- OpenFGA and SpiceDB: relationship schemas and tuples for graph-shaped authorization. https://openfga.dev/docs/modeling/getting-started and https://authzed.com/docs/spicedb/concepts/schema
- XACML: standardized ABAC language/architecture with combining algorithms and obligations. https://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html
- Casbin and Oso Polar: configurable/embedded application authorization. https://casbin.org/docs/syntax-for-models/ and https://www.osohq.com/docs/reference/polar
- Kyverno and Kubernetes ValidatingAdmissionPolicy: domain policy resources represented in YAML, with expression facilities including CEL/JMESPath. https://kyverno.io/docs/introduction/how-kyverno-works/ and https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/
- OpenID AuthZEN: policy decision API, not a policy language. https://openid.net/specs/authorization-api-1_0.html

## Product authoring classifications

- AWS Bedrock AgentCore: Cedar; Dogwood; natural-language generation of Cedar.
- Google Gemini Enterprise Agent Platform: natural-language semantic constraints evaluated at runtime.
- Microsoft Entra Agent ID: Conditional Access UI and Microsoft Graph policy objects.
- Microsoft AGT: Agent Mesh YAML/JSON rule DSL; optional Rego; ACS binds Rego, Cedar, custom, or test policy executors.
- Ping Agent Governance: workflow/UI controls; no public executable grammar.
- Cisco AI Defense: UI rules and natural-language Policy Studio; generated representation is undisclosed.
- Palo Alto Prisma AIRS: UI/API profiles and semantic topics; no public general DSL.
- Holistic AI Guardian Agents: proprietary rules/workflows; no public grammar.
- Check Point/Lakera: structured detector rules through UI/API; JSON is configuration.
- IBM watsonx.governance: console workflows, artifacts, and metric thresholds; not inline authorization DSL.
- Salesforce: Policy Builder/templates and managed rules; no public native DSL.
- Descope: console allow rules and structured conditions; no public policy API/DSL.
- Docker MCP Enterprise Gateway: Cedar in Docker's MCP namespace.
- Stacklok ToolHive: Cedar carried in JSON/YAML or Kubernetes resources; enterprise RBAC resources compile to Cedar.
- Lasso: proprietary no-code rules; syntax undisclosed.
- Cerbos: YAML/JSON policy documents with CEL conditions.
- Permit.io: UI, Rego, Cedar, and relationship tuples.
- Okta Cross App Access: structured connection and OAuth-scope allowlists.
- Oasis: proprietary deterministic engine; authoring format undocumented.
- Credo AI Agent Governor: generated Claude Code hooks/skills/settings; no public standalone grammar.
- Galileo Agent Control: recursive executable JSON control model.
- NVIDIA NeMo Guardrails: Colang, YAML configuration, and Python actions.
- Phoenix/AgentOps/LangSmith: primarily code evaluators, telemetry, and automation configuration rather than enforcement policy languages.

## Evaluation criteria

For each policy system, assess: formal semantics; type/schema validation; unit tests; simulation; conflict/combining behavior; explanation and decision trace; versioning/GitOps/signing/promotion; offline execution; performance bounds; failure defaults; obligations/transforms/approval; and whether the enforcement point is non-bypassable.

## CAF implication

CAF should define a vendor-neutral request/decision contract and avoid a canonical language. Start with schema-governed JSON/YAML for a small closed policy vocabulary; add a bounded expression tier only when required; evaluate Cedar for authorization and OPA/Rego for heterogeneous host policy behind the same provider interface. Natural-language authoring should normally compile to deterministic, reviewable policy for consequential decisions.