Writing Policies

Writing Policies

Brane uses eFLINT to express data access policies. eFLINT is a formal language for institutional rules — it lets you declare what actions are permitted or prohibited under specific conditions.

eFLINT Basics

eFLINT works with a few core concepts:

• Facts — Things that are true (e.g., “this dataset exists”, “this user is authorized”)
• Acts — Actions that can happen (e.g., “access data”, “run function”)
• Duties — Obligations that must be fulfilled
• Violations — Conditions that indicate a rule has been broken

Example: Hospital Data Policy

Here’s a policy that allows local model training but prevents raw data export:

// Define the facts about our domain
Fact dataset Identified by name.
Fact function Identified by name.
Fact user Identified by name.

// Define possible actions
Act access-dataset
  Actor user
  Recipient dataset.

Act run-function
  Actor user
  Recipient function.

Act export-data
  Actor user
  Recipient dataset.

// Rules: allow local operations, deny export
+run-function When function.name == "train_local".
+access-dataset When True.
-export-data When True.

This policy:

• Allows any user to access datasets on this node
• Allows the train_local function to execute
• Denies all data export operations

Common Policy Patterns

Allow All (Development Only)

// WARNING: Only use for testing
+access-dataset When True.
+run-function When True.
+export-data When True.

Deny All (Default)

The default policy when no rules are set. All actions are denied.

Allow Specific Functions

+run-function When function.name == "aggregate_results".
+run-function When function.name == "compute_statistics".
-run-function When True.

Allow Results but Not Raw Data

+access-dataset When True.
+run-function When True.
-export-data When dataset.type == "raw".
+export-data When dataset.type == "aggregated".

Deploying Policies

Using the Policy Reasoner GUI

1. Open the GUI in your browser
2. Enter the node address and your access token
3. Write or paste your eFLINT policy
4. Click “Activate” to deploy

Using branectl

branectl policy push ./my-policy.eflint \
  --node http://<WORKER_ADDRESS> \
  --token ./policy_token.json

branectl policy activate <POLICY_ID> \
  --node http://<WORKER_ADDRESS> \
  --token ./policy_token.json

Testing Policies

Offline Testing

Use the eFLINT REPL to test your policies without deploying:

eflint-repl my-policy.eflint

In the REPL, you can:

• Create test facts
• Attempt actions and see if they are allowed
• Inspect the current state

On the Node

After deploying, test by running workflows that exercise your policy rules. Check that:

• Allowed operations succeed
• Denied operations fail with policy violation errors

Tips

• Start with a deny-all policy and explicitly allow what’s needed
• Test policies offline before deploying to a live node
• Document each policy rule with comments explaining the rationale
• Review policies regularly as requirements change
• Coordinate with other domain administrators when cross-domain operations are needed