--- title: Custom Authorization Policies with `@policy` in Hive Router description: Hive Router now supports the Federation @policy directive, allowing authorization decisions that require external data (like resource ownership or tenant... canonical: https://daily.dev/posts/custom-authorization-policies-with-policy-in-hive-router-3lt2dy4nm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Custom Authorization Policies with `@policy` in Hive Router | daily.dev og:description: Hive Router now supports the Federation @policy directive, allowing authorization decisions that require external data (like resource ownership or tenant... og:url: https://daily.dev/posts/custom-authorization-policies-with-policy-in-hive-router-3lt2dy4nm og:image: https://api.daily.dev/og/posts/3Lt2dY4Nm.png og:image:alt: Custom Authorization Policies with `@policy` in Hive Router og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Custom Authorization Policies with `@policy` in Hive Router **[The Guild](https://daily.dev/sources/guild)** · 1 min read · 0 upvotes · 0 comments ## Summary Hive Router now supports the Federation @policy directive, allowing authorization decisions that require external data (like resource ownership or tenant isolation) to be delegated to a coprocessor, rather than relying only on @authenticated and @requiresScopes which work from JWT claims alone. Before the graphql.analysis coprocessor stage runs, the router collects required policies into a request context key as null values, and the coprocessor must explicitly set true/false; anything left null or unanswered is denied and handled per the configured unauthorized mode. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the @policy directive work in Hive Router for GraphQL federation authorization? The @policy directive delegates authorization decisions requiring external data to a coprocessor, unlike @authenticated and @requiresScopes which decide from a JWT alone. Before the graphql.analysis coprocessor stage runs, the router publishes every required policy to the hive::authorization::required_policies request context key as null, and the coprocessor overwrites each with true or false. _Developers wiring custom authorization into GraphQL federation can follow policy directive updates on daily.dev._ ### What happens if a Hive Router policy is left undecided by the authorization coprocessor? Any policy left as null, or missing from the coprocessor's response, is treated as denied. There is no way to leave a policy undecided and still access the field it protects; denied fields are then handled according to the configured authorization.directives.unauthorized.mode setting. _Teams tightening GraphQL access control rules can track authorization edge cases like this on daily.dev._ ## Similar posts on daily.dev - [Advanced authentication and authorization for MCP Gateway](https://daily.dev/posts/advanced-authentication-and-authorization-for-mcp-gateway-pvnkwks5z) · Red Hat Developer · 0 upvotes · 0 comments - [Per-Tool OAuth Scopes for MCP, Derived from Your Schema](https://daily.dev/posts/per-tool-oauth-scopes-for-mcp-derived-from-your-schema-y05pmgghg) · WunderGraph · 0 upvotes · 0 comments - [Policy-Based Authorization in ASP.NET Core](https://daily.dev/posts/policy-based-authorization-in-asp-net-core-3ynswpeoj) · Code with Mukesh · 11 upvotes · 1 comments - [HubSpot Redesigns JITA Authorization with Rule Engine Architecture](https://daily.dev/posts/hubspot-redesigns-jita-authorization-with-rule-engine-architecture-7srnyocbs) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#graphql](https://daily.dev/tags/graphql), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/custom-authorization-policies-with-policy-in-hive-router-3lt2dy4nm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Custom Authorization Policies with `@policy` in Hive Router","url":"https://daily.dev/posts/custom-authorization-policies-with-policy-in-hive-router-3lt2dy4nm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/custom-authorization-policies-with-policy-in-hive-router-3lt2dy4nm"},"datePublished":"2026-09-01T16:41:11.900Z","dateModified":"2026-09-01T16:54:15.136Z","description":"Hive Router now supports the Federation @policy directive, allowing authorization decisions that require external data (like resource ownership or tenant...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f255c020e138d6f620d5db3a7ae33787?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f255c020e138d6f620d5db3a7ae33787?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Guild","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Guild","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ee61cd9a12684e9889775727044e4a49","url":"https://daily.dev/sources/guild"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/custom-authorization-policies-with-policy-in-hive-router-3lt2dy4nm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,graphql,authorization","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Guild","item":"https://daily.dev/sources/guild"},{"@type":"ListItem","position":3,"name":"Custom Authorization Policies with `@policy` in Hive Router"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/custom-authorization-policies-with-policy-in-hive-router-3lt2dy4nm#faq","mainEntity":[{"@type":"Question","name":"How does the @policy directive work in Hive Router for GraphQL federation authorization?","acceptedAnswer":{"@type":"Answer","text":"The @policy directive delegates authorization decisions requiring external data to a coprocessor, unlike @authenticated and @requiresScopes which decide from a JWT alone. Before the graphql.analysis coprocessor stage runs, the router publishes every required policy to the hive::authorization::required_policies request context key as null, and the coprocessor overwrites each with true or false. Developers wiring custom authorization into GraphQL federation can follow policy directive updates on daily.dev."}},{"@type":"Question","name":"What happens if a Hive Router policy is left undecided by the authorization coprocessor?","acceptedAnswer":{"@type":"Answer","text":"Any policy left as null, or missing from the coprocessor's response, is treated as denied. There is no way to leave a policy undecided and still access the field it protects; denied fields are then handled according to the configured authorization.directives.unauthorized.mode setting. Teams tightening GraphQL access control rules can track authorization edge cases like this on daily.dev."}}]} ```