The policy bench.
Change one part of the request at a time. This is a deterministic teaching model: it never verifies a real token, resolves DNS or contacts a destination.
Evaluated against preset policy
ALLOW
Read access to the ledger origin.
All checks are shown for learning. An enforcement layer may stop at the first denial. Inputs remain in this page.
The policy under test
principal = invoice-worker (fixed in this lab)
credential = verified and within lifetime
audience = ledger-api
allowed task = invoice:read
origin = https://ledger.example:443
redirect = none, or the same allowed HTTPS originHost, effective port and scheme form the origin. Embedded usernames or passwords are rejected. A permitted origin is not a promise about every path or object behind it. The example does not test authorization for invoice 42, IP routing, DNS rebinding, signatures or actual redirects. The apparent validity of an input is a scenario assumption.