Test access decisions

Use Console Live Testing with a precise site user, resource, action, and resource-attribute object. First test an allowed case, then change exactly one fact and verify the denied case.

Prerequisites

• A saved resource policy, target site, and target app are selected.
• An active site user and one entity:name resource from the app's inspected policies are available.
• At least one action and a valid JSON object containing the resource attributes required by the condition are prepared.
• The allowed and denied cases differ by one deliberate attribute value.

Live Testing can change the policy

The Policy YAML panel is editable. Reset restores the saved text, while Save mutates and replaces the full policy definition. Don't select Save when you only want to test. To change the policy on purpose, see Manage policies in the Console.

Complete the Live Testing inputs

Console control	Required input
User	Select an active site user. The roles displayed below the user are preview only; the check resolves the current roles on the server.
Resources & actions	Keep each decision target in its own resource row.
Resource	Select the inspected entity:name. A free-typed mismatched resource does not receive the saved policy scope.
Attributes (optional)	Enter a valid JSON object for resource.attr, such as {"status": "active"}.
Actions	Select at least one action supported by that resource policy.

Run the allowed and denied checks

1. In the target app's Policy Editor, open the saved policy and select Live Testing.
2. Complete User, Resource, Attributes (optional), and Actions with the allowed case.
3. Select Run Check and record the ALLOW cell in Check results.
4. Change exactly one resource attribute so the condition no longer matches.
5. Select Run Check again and record the DENY cell for the same user, resource, and action.
6. Compare the two inputs and results without selecting Save.

Resolve input and request failures

Failure	Action
No user	Select an active site user before running the check.
Invalid resource	Use entity:name, preferably from the inspected Resource list.
No actions	Select at least one action for each resource row.
Invalid JSON	Correct Attributes (optional) to a JSON object, not an array or scalar.
Missing inspected policy	Refresh the policy list. If the synchronized policy remains missing, stop and contact TaruviBase support instead of inventing a resource name.
Unexpected response	Preserve the app, resource, actions, UTC time, and redacted response, then stop the release check.
Request failure	Preserve the safe error and request context; do not reinterpret the failure as DENY or ALLOW.

Verification

The expected result is one ALLOW and one DENY decision for the same active site user, resource, and action, with exactly one deliberate attribute difference.

Record both outcomes with the policy's full diff. A test that exercises only an allow result cannot show that the condition or role boundary is effective.