Policy Structure

Overview

This document defines the structure and configuration options for the Autheona Policy Engine rules. Policies are JSON-based rule sets evaluated by the AST-based engine to determine actions (allow, block, ignore) based on email, domain, and IP intelligence data.

Policy Structure

A Policy is the root container for all rules. It defines the schema version, the top-level rule set, and execution behavior.

{
  "version": "1.0",
  "stop_on_block": true,
  "parent_rules": [
    {
      "field": "domain_disposable",
      "operator": "==",
      "target": {
        "bool": true
      },
      "action": "block"
    }
  ]
}

Policy Fields

Rule Structure

A Rule is a single evaluation unit within the policy tree. Every rule acts as either a Logical Branch (grouping other rules) or a Leaf Condition (performing a comparison).

Leaf Condition Structure

{
  "field": "email_deliverable",
  "operator": "==",
  "target": {
    "bool": false
  },
  "action": "block"
}

Logical Branch Structures

AND Branch (all children must match):

{
  "and_rules": [
    {
      "field": "domain_valid_tld",
      "operator": "==",
      "target": {
        "bool": true
      },
      "action": "allow"
    },
    {
      "field": "email_deliverable",
      "operator": "==",
      "target": {
        "bool": true
      },
      "action": "allow"
    }
  ]
}

OR Branch (any child must match):

{
  "or_rules": [
    {
      "field": "domain_disposable",
      "operator": "==",
      "target": {
        "bool": true
      },
      "action": "block"
    },
    {
      "field": "domain_typo",
      "operator": "==",
      "target": {
        "bool": true
      },
      "action": "block"
    }
  ]
}

NOT Branch (negates the child rule):

{
  "not_rule": {
    "field": "domain_valid_tld",
    "operator": "==",
    "target": {
      "bool": true
    },
    "action": "block"
  }
}

Rule Fields

Actions

Actions define the verdict applied when a rule condition matches.

Action Resolution Hierarchy

The engine uses a Fail-Closed security posture. When multiple actions are triggered:

1. block (highest priority)
2. allow (lowest priority)

If any rule triggers a block, it overrides all permissive rules.

Operators

Operators define how the field value is compared against the target.

Boolean Operators

Numeric Operators

List Operator

Available Fields

Fields are categorized by their target value type and the supported operators.

Boolean Fields

These fields evaluate to true or false. Supported operators: ==, !=.

Email Boolean Fields

Numeric Fields

These fields evaluate to a number. Supported operators: ==, !=, <, >, <=, >=.

Email Numeric Fields

String List Fields

These fields check if a value exists within a user-defined list. Supported operator: list.

Email String List Fields

Target Configuration

The target object specifies the expected value for comparison. Only include the field matching the rule's data type.

Boolean Target

{
  "target": {
    "bool": true
  }
}

{
  "target": {
    "bool": false
  }
}

Numeric Target

{
  "target": {
    "number": 30
  }
}

{
  "target": {
    "number": 5.5
  }
}

String Target (for List Operator)

{
  "target": {
    "string": "reference-key"
  }
}

Example Policies

Block Disposable Emails

Blocks any email from a disposable email provider.

{
  "version": "1.0",
  "stop_on_block": true,
  "parent_rules": [
    {
      "field": "domain_disposable",
      "operator": "==",
      "target": {
        "bool": true
      },
      "action": "block"
    }
  ]
}

Block Undeliverable and Fraudulent Emails

Uses an OR branch to check multiple conditions.

{
  "version": "1.0",
  "stop_on_block": false,
  "parent_rules": [
    {
      "or_rules": [
        {
          "field": "email_deliverable",
          "operator": "==",
          "target": {
            "bool": false
          },
          "action": "block"
        },
        {
          "field": "local_fraud_pattern",
          "operator": "==",
          "target": {
            "bool": true
          },
          "action": "block"
        }
      ]
    }
  ]
}

Allow Only Corporate Domains

Uses the list operator to check against a custom domain whitelist.

{
  "version": "1.0",
  "stop_on_block": true,
  "parent_rules": [
    {
      "field": "domain_custom_domains",
      "operator": "list",
      "target": {
        "string": "reference-key"
      },
      "action": "allow"
    },
    {
      "field": "domain_custom_domains",
      "operator": "list",
      "target": {
        "string": "reference-key"
      },
      "action": "block"
    }
  ]
}

Complex Multi-Condition Policy

Combines AND and OR logic with short-circuit evaluation.

{
  "version": "1.0",
  "stop_on_block": true,
  "parent_rules": [
    {
      "and_rules": [
        {
          "field": "domain_valid_tld",
          "operator": "==",
          "target": {
            "bool": true
          },
          "action": "ignore"
        },
        {
          "or_rules": [
            {
              "field": "domain_age_days",
              "operator": "<",
              "target": {
                "number": 30
              },
              "action": "block"
            },
            {
              "field": "subdomain_count",
              "operator": ">",
              "target": {
                "number": 10
              },
              "action": "allow"
            }
          ]
        }
      ]
    }
  ]
}