Test a policy against a real user before it goes live.
Dry-run a principal against your policies, or run a real retrieval and see results split into allowed and denied, with reasons. Validate before production.
The Access Simulator and Live Preview require the Growth plan or above (access_simulator entitlement).
Dry Run and Live Preview
Dry Run evaluates a chosen principal against your active policies and shows the decision and the matching policy, without executing a retrieval. It answers the question "what would happen if this user queried this." Live Preview goes further: it runs a real retrieval as the principal against a connector and returns the results split into two panels, allowed results with a content preview, and denied results with their denial reason but no content.
Both run the same async policy evaluator used in production, including relationship (ReBAC) conditions, so what you see in preview is what production will do.
Batch preview and guardrails
Batch preview evaluates up to five principals against one search at once, so you can confirm that a manager sees more than an intern, or that an external user sees nothing restricted, in a single view. top_k is capped at 20 for preview, lower than production retrieval, to keep previews fast.
Live Preview enforces readiness guards: the connector must be connected, and there must be at least one active principal and one active policy. If a guard is not met, the endpoint returns a clear blocking_reason rather than a misleading empty result. Preview is rate limited to protect the shared evaluator.
Frequently asked questions
Why do denied results have no content?
By design. A denied result returns its metadata and the reason it was denied, never the content the principal is not allowed to see. This lets you confirm a policy is working without exposing the very data the policy protects.
What is the difference between Dry Run and Live Preview?
Dry Run evaluates policies against a principal without touching the vector store; it is instant and shows the decision and matching policy. Live Preview executes a real retrieval against the connector and shows the actual allowed and denied results for that principal.
Does the Simulator reflect ReBAC relationships?
Yes. Live Preview runs the full async policy evaluator, so relationship conditions (relation.owner_of and similar) are resolved exactly as they are in production, and the evaluation trace shows which conditions matched.