Comment by mangudai

Nice, the scope here feels right - a lot of policy management tools try to do too much and end up being their own attack surface. Are you handling policy conflicts (two rules touching the same resource) at apply-time or just documenting "last write wins" and leaving it to the admin?