Splits off the Value from the FQN to get the parent Definition FQN: Input: https://<namespace>/attr/<attr name>/value/<value> Output: https://<namespace>/attr/<attr name>.

GroupDefinitionsByFqn takes a slice of Attribute Definitions and returns them as a map: FQN -> Attribute Definition.

Groups Attribute Values by their parent Attribute Definition FQN.

DataRuleResult represents the rule-level (or AttributeDefinition-level) decision for a specific entity - the result of comparing entity Attribute Values to a single data AttributeDefinition/rule (with potentially many values) There may be multiple "instances" (that is, Attribute Values) of a single AttributeDefinition on both data and entities, each with a different value.

A Decision represents the overall access decision for a specific entity, - that is, the aggregate result of comparing entity Attribute Values to every data Attribute Value.

ValueFailure indicates, for a given entity and data Attribute Value, which data values (aka specific data Attribute Value) the entity "failed" on.