Policy lifecycle
Where the relations and conditions that the PDP queries come from, and how they reach OpenFGA.
The PDP reads relations in OpenFGA and conditions in PostgreSQL, but neither is where the administrator works. The administrator edits one permission document per agent, in the Admin, and publishes it. Publication validates the document, stores the revision and turns the document into tuples in OpenFGA.
The permission document describes what each agent can do. Publication and reconciliation explain how it reaches OpenFGA without ever opening more access than the administrator published, even when something fails midway.