Step 1

3.0-kbac policy with dynamic routing. $region routes graph.byName() and must not be referenced anywhere else in the Cypher. Platform-bound parameters ($subject_external_id, $subject_type, $resource_external_id, $resource_type) cannot be used as routing parameters, and $subject_id must not appear at all.

{
  "meta": {
    "policy_version": "3.0-kbac"
  },
  "subject": {
    "type": "Person"
  },
  "actions": [
    "CAN_DRIVE"
  ],
  "resource": {
    "type": "Car"
  },
  "condition": {
    "cypher": "USE graph.byName($region) MATCH (subject:Person)-[:OWNS]->(resource:Car)"
  }
}

Request to create the location-routed policy using REST.

{
  "project_id": "your_project_gid",
  "description": "3.0-kbac data-residency policy. $region is a location parameter: it routes graph.byName() and must not be referenced anywhere else in the Cypher. Callers supply a logical location (an alias_mapping key such as east or west) in context.input_params.region; IndyKite translates it to the physical constituent database just before execution.",
  "display_name": "policy - can drive (location-routed)",
  "name": "policy-can-drive-location-routed",
  "policy": "{\"meta\":{\"policy_version\":\"3.0-kbac\"},\"subject\":{\"type\":\"Person\"},\"actions\":[\"CAN_DRIVE\"],\"resource\":{\"type\":\"Car\"},\"condition\":{\"cypher\":\"USE graph.byName($region) MATCH (subject:Person)-[:OWNS]->(resource:Car)\"}}",
  "status": "ACTIVE",
  "tags": []
}

Step 2

Evaluation routed to the east location. "east" is a logical location - a key of the project's alias_mapping - not a Neo4j database name. IndyKite resolves it to the physical constituent just before running the condition.

{
  "subject": {
    "type": "Person",
    "id": "person-alice"
  },
  "resource": {
    "type": "Car",
    "id": "car-kitt"
  },
  "action": {
    "name": "CAN_DRIVE"
  },
  "context": {
    "input_params": {
      "region": "east"
    }
  }
}

Response - allowed: the OWNS relationship exists in the east constituent.

{
  "decision": true
}

The same east-routed evaluation in Python.

import http.client
import json

conn = http.client.HTTPSConnection("eu.api.indykite.com")

payload = json.dumps({
  "subject": {"type": "Person", "id": "person-alice"},
  "resource": {"type": "Car", "id": "car-kitt"},
  "action": {"name": "CAN_DRIVE"},
  # "east" is a logical location (an alias_mapping key), never a Neo4j database name
  "context": {"input_params": {"region": "east"}}
})

headers = {
  'Content-Type': "application/json",
  'X-IK-ClientKey': ""
}

conn.request("POST", "/access/v1/evaluation", payload, headers)

res = conn.getresponse()
data = res.read()

Step 3

The identical question routed to the west location.

{
  "subject": {
    "type": "Person",
    "id": "person-alice"
  },
  "resource": {
    "type": "Car",
    "id": "car-kitt"
  },
  "action": {
    "name": "CAN_DRIVE"
  },
  "context": {
    "input_params": {
      "region": "west"
    }
  }
}

Response - denied: no matching data in the west constituent. Same subject, same resource, same policy; only the location changed.

{
  "decision": false
}

Step 4

Request with a location that is not a key of alias_mapping.

{
  "subject": {
    "type": "Person",
    "id": "person-alice"
  },
  "resource": {
    "type": "Car",
    "id": "car-kitt"
  },
  "action": {
    "name": "CAN_DRIVE"
  },
  "context": {
    "input_params": {
      "region": "north"
    }
  }
}

Response - the call fails before evaluation. The error names the logical location and the parameter; the physical database alias is never exposed.

{
  "message": "Unprocessable Entity",
  "errors": [
    "unknown location \"north\" for parameter \"$region\""
  ]
}

Step 5

Resource search scoped to the east location - which cars can alice drive there? Search endpoints take the location parameter exactly like evaluation.

{
  "subject": {
    "type": "Person",
    "id": "person-alice"
  },
  "action": {
    "name": "CAN_DRIVE"
  },
  "resource": {
    "type": "Car"
  },
  "context": {
    "input_params": {
      "region": "east"
    }
  }
}

Response - resource references from the east constituent.

{
  "results": [
    {
      "type": "Car",
      "id": "car-kitt"
    }
  ]
}

Step 6

Delete the policy when done.

{
  "id": "your_policy_configuration_gid"
}