Policy partial results

摘要

Technology for policies with reduced associated costs is disclosed. A policy may include an ordered rule set. When evaluated, the highest priority rule in the order that does not skip may control the policy outcome. Rules within a policy may have associated costs, such as data fetch and evaluation costs. In some contexts, it may be less important to evaluate every rule than to evaluate the policy quickly. Reduced policies that have one or more rules removed or that skip evaluation of some rules may be created for these contexts. When a rule of a policy is skipped, it may result in a possibility of a false allow or false deny. In some cases, rules may be duplicative. Removal or skipping of duplicative rules does not increase the possibility of a false allow or false deny. By using reduced policies in identified contexts, policy evaluation costs may be reduced.

主权项

1. A method comprising:
receiving a policy comprising at least two rules with an order indicated among the at least two rules; receiving reduction parameters that specify a minimum amount of savings that a reduced rule policy should achieve, wherein the reduction parameters comprise one or more of:
an indication of a cost savings, as a value, that the reduced rule policy should achieve,an indication of a cost savings, as a percentage of a calculated initial cost of the policy, that the reduced rule policy should achieve,an indication of a cost savings amount that should be achieved by removing a selected rule, as a function of an amount of increased likelihood of false allow or false deny resulting from removing the selected rule, that qualifies the selected rule for removal, orany combination thereof; selecting, as a candidate rule set, one or more rules of the at least two rules, wherein the candidate rule set is removable from the policy; determining a cascade rule set, wherein each rule of the cascade rule set is rendered duplicative by removal of:
the at least one rule of the candidate rule set, and/orat least one rule of the cascade rule set,wherein a combination of the candidate rule set and the cascade rule set are removable from the policy; combining, into a result set, the candidate rule set and the cascade rule set; and providing an indication of the rules in the result set, wherein a subsequent evaluation of the policy uses a reduced rule version of the policy that excludes the indicated rules of the result set.