Simulator

Simulator answers "what would happen if…" before anyone publishes. Pick a Role, a Connection and a Tool; for a cluster, type a Namespace; for a write, a Reason. Two answers appear side by side: by the draft in Policy, and by the version in force. Each says Allowed or Denied, the tier the target falls in and the rule that set it, whether personal values would be shown or masked, and the sentence a denied caller would read.

• A connection you have not added yet can be tried as "a connection on prod", on lower or on sandbox.
• Nothing here writes; "Any tool that writes" tries a role's write grants all the same.
• Where a product has no tool that reads personal data, "Any tool that reads personal data" stands in for one.
• Simulator runs the same decision the gateway and every agent run, so its answer is theirs.

Try it: choose Reader and "Any tool that writes". The answer is denied: "Reader cannot act on prod…".