The decision
The PDP decides ALLOW or DENY by combining relations in OpenFGA and call conditions in CEL.
The decision answers two different questions. The first is structural: is there a relation that links this subject, this agent, this tool and this resource? The second is about the moment: does the data of this specific call meet the conditions that the customer set? The first has an answer before the call exists, because the relations were published by the administrator. The second only has an answer with the arguments and the facts in hand.
Xokepoint uses one tool for each. OpenFGA stores the relations and traverses them. The PDP evaluates the conditions in CEL. Neither alone permits: the decision requires both.
The mode of the agent only changes what a deny of its policy does. In Report-only, a missing grant, a missing resource or a false condition is recorded as Would deny and the call runs. A missing delegation still stops the call in both modes.
The pages of this group follow that order: the roles, why relations, the model, the evaluation order, the conditions and what happens when something fails.