[feature] support the new "a" type policies (aka LLM AI policy)

Author: hsluoyzCreated Jan 25, 2026Updated Jan 25, 2026

Labelsenhancement

see: https://editor.casbin.org/#6W5HP2HEM

need to support the new "a" type policy (means AI LLM policy, can be "a", "a2", "a3" like p and g policy), like:

a, "if the request object contains anything like credential/secret leak, then deny"

so Casbin will call the LLM API (use the new Explain API in: https://github.com/casbin/casbin/commit/0fe9505818b12d66739b8e86887539b3ce57942a) to determine the "a" policy: "if the request object contains anything like credential/secret leak, then deny".

Casbin Policy Configuration

Model

[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = ipMatch(r.sub, p.sub) && r.obj == p.obj && r.act == p.act

Policy

p, 192.168.2.0/24, data1, read
p, 10.0.0.0/16, data2, write
a, "allow US residential IPs to read data1" # "residential" means not cloud IPs
a, "allow global cloud IPs to write data2"

Request

192.168.2.1, data1, read
10.0.2.3, data2, write

Enforcement Result

(empty)

Source: apache/casbin

View original on GitHub View discussion on GitHub