Policy engine

A JSON rules editor that maps risk facts to allow / otp / step-up / deny, evaluated live against sample sessions.