Enforce a trusted access decision

Advanced60 min

Implement decide_access(principal, resource, action, now) as a deterministic policy evaluator with tenant, scope, classification, and expiration checks.

Your task

principal is a trusted dict containing nonempty tenant, nonnegative integer clearance, and a list/set/tuple of string scopes. resource contains nonempty tenant, nonnegative integer classification, and finite numeric expires_at.
action must be read or export and now must be finite. Reject malformed values by returning {"allowed": False, "reason": "invalid"}; booleans are not numeric inputs.
Apply denial checks in order: tenant mismatch, missing action scope, insufficient clearance, expired resource. Expiry is exclusive: now >= expires_at denies.
Return reason tenant, scope, classification, or expired for those denials; otherwise return {"allowed": True, "reason": "allowed"}.
This function assumes identity and resource metadata were authenticated and loaded by trusted services. Model-generated claims must not be passed as trusted principal metadata.

Examples

EXAMPLE 1

InputTenant red with read scope, clearance 2; red resource classification 2, expires_at 100; now 99

Output{"allowed": True, "reason": "allowed"}

Changing action to export denies because permissions are action-specific.

def decide_access(principal, resource, action, now):
    raise NotImplementedError