Policy Bundle
A versioned package of compiled policy that a central authoring point publishes to a registry, which distributed PDPs — sidecars, edge functions — pull and hot-load independently.
Bundle distribution is what makes decentralized authorization consistent without a central decider on the request path: every PDP pulls from the same registry, trading instant consistency for availability — a sidecar with a slightly stale bundle still decides correctly against last week’s policy rather than failing open or closed. Decision logs, tagged with the exact bundle version that produced them, are what recovers the centralized auditability this trade-off gives up.