The PIP Service is a standalone component of the Platform that enables the Authorization Platform to retrieve external data to support Policy decisions.
It allows the Runtime to enrich authorization requests with external Attributes, making decisions more dynamic and context-aware.
This section includes:
- Management – Define and manage Data Sources, Views, and caching.
- Operator – Configure and monitor the PIP Operator Service.
The PIP Service:
- Supports a wide range of Data Sources
- Enables relationships between external Attributes
- Allows multiple Models per Data Source
- Provides flexible deployment options for each Policy Authorization Agent (PAA)
- Supports API-based management of Sources and Views.
For detailed configuration and operational guidance, refer to the following related articles:
Overview
The PIP Service connects the Authorization Platform to external systems such as databases and directories.
At a high level, it is built on two main concepts:
- Data Sources – Connections to external systems.
- Views – Virtual representations of external data structured for Policy use.
Data Sources define where data originates.
Views define how that data is filtered, combined, and presented to the Runtime.
This approach enables you to:
- Use external data in Policy evaluation.
- Combine Attributes from multiple systems.
- Represent external data as Identities or Assets.
Architecture
The PIP Service supports high-availability deployments across multiple Data Centers.
Typical deployments include:
- Multiple Runtime and PIP components.
- Replicated Policy Administration Points (PAP).
- Load balancers for traffic distribution and failover.
If a component or Data Center becomes unavailable, traffic is automatically redirected to ensure uninterrupted service.
Organizations can deploy:
- A single entry point with centralized load balancing, or
- Multiple entry points, where each Data Center handles local traffic.
--