Module policy 

Security-policy evaluation (Check … statements).

Functions

check_policy

Run a Check statement against already-resolved subject/object values. Every error string lives here — both engines produce the identical text.

evaluate_policy_condition

Evaluate one policy condition against a subject (and optional object).