Skip to main content

Use the Google Drive Evaluator

Now that you have created your policy instance, you can test it out with the Evaluator. The Evaluator supports several requests, corresponding to Aserto's authorization APIs - is, decisiontree, and query. The default "Check" request, however, is specifically designed for policy-rebac. Using the Evaluator allows you to quickly verify whether a user has a relationship (or permission) on an object.

The Evaluator has two parts. The REQUEST part on the left is where you specify information about the action being performed, while the OUTPUT on the right displays the body of the request as well as the response.

The table below explains the selection fields.

FieldDescription
SubjectThe user to evaluate. For Google Drive there are 5 Citadel users that you can select from.
Object TypeThe type of object to evaluate. For Google Drive this will be Doc.
ObjectThe object instance to evaluate.
RelationWhich relation or permission to evaluate.

Testing the policy​

Now let's check a few different scenarios using the Evalator. First, a few important things to note about Rick and Morty:

  • Rick is an owner of the rick folder, which contains the rick.inventions doc. This means he has the can_read, can_write, and can_delete permissions on the rick folder, which are inherited by the rick.inventions doc.
  • Every user is a viewer of the groceries doc. This means that both Rick and Morty have the can_read permission on this doc, but they have no other permission.

Scenario 1 - can Rick read the rick.inventions doc?​

  • For Subject, select "Rick Sanchez".
  • For Object Type, select "Doc".
  • For Object, select "Rick's inventions".
  • For Relation, select "can-read".
  • Click the Play button.
  • You should see "is": true under results indicating the action will be permitted.

Scenario 2 - can Rick delete the rick.inventions doc?​

  • For Subject, select "Rick Sanchez".
  • For Object Type, select "Doc".
  • For Object, select "Rick's inventions".
  • For Relation, select "can-delete".
  • Click the Play button.
  • You should see "is": true under results indicating the action will be permitted.

Scenario 3 - can Morty read the rick.inventions doc?​

  • For Subject, select "Morty Smith".
  • For Object Type, select "Doc".
  • For Object, select "Rick's inventions".
  • For Relation, select "can-read".
  • Click the Play button.
  • You should see "is": false under results indicating the action will be denied.

Scenario 4 - can Rick read the groceries doc?​

  • For Subject, select "Rick Sanchez".
  • For Object Type, select "Doc".
  • For Object, select "Grocery list".
  • For Relation, select "can-read".
  • Click the Play button.
  • You should see "is": true under results indicating the action will be permitted.

Scenario 5 - can Rick delete the groceries doc?​

  • For Subject, select "Rick Sanchez".
  • For Object Type, select "Doc".
  • For Object, select "Grocery list".
  • For Relation, select "can-delete".
  • Click the Play button.
  • You should see "is": false under results indicating the action will be denied.

Next steps​

Now that you have seen how the policy works, you'll use the Quickstart in the console to download and run the sample back-end API, which uses the gdrive policy for access control.

Click on the "Quickstart" tab on the left.