A Policy Decision Point is the service or component that evaluates an authorization policy and returns an allow-or-deny decision. In a common access-control design, the application asks the PDP whether a user may perform an action on a resource, and the PDP checks roles, attributes, relationships, or policy rules before replying. The actual enforcement may happen elsewhere, but the PDP is the logic layer that makes the decision.
PDPs matter because they centralize authorization in one place instead of scattering checks across many code paths. That improves consistency, auditing, and rollback, especially in cloud and SaaS systems with fine-grained permissions. In defense, teams version policies, test allow/deny behavior, and monitor decision latency and logs. In attacks, a compromised or misconfigured PDP can cause overly broad access, accidental denial of service, or policy bypass if enforcement is weak or the decision service is unavailable.