All IAM glossary termsAuthorization · glossary
PDP (Policy Decision Point)
Also known as: Policy Decision Point
Definition
A PDP (Policy Decision Point) is the component that evaluates policy against a request and returns an authorization decision — typically distinct from the application doing the enforcement.
In more depth
In a centralized-authorization architecture, the PDP holds all the policy logic. The PEP queries it. Externalized PDPs include Open Policy Agent (OPA), Amazon Cedar, AuthZed SpiceDB, OpenFGA, and commercial PDPs like Cerbos and Styra.
The PDP/PEP split is a foundational ABAC/PBAC pattern. It keeps policy out of application code, enabling consistent enforcement and easier auditing.
Want the work, not just the definition?