A predicate is a logical condition that evaluates to true or false. In security systems, predicates are used to decide whether a user may access a record, run an action, or match a filter. Common examples include checking a role, comparing a timestamp, or verifying that a request comes from an approved tenant. When the predicate is true, access continues; when it is false, the data or action is blocked.
Predicates matter because authorization often depends on them. In databases, APIs, and policy engines, a small mistake in predicate logic can weaken a control or invert its meaning. Attackers look for these bugs by testing denied paths, altered parameters, and nested conditions that behave differently from the intended rule. Defenders should review complex filters carefully, especially when policy is translated into query language or rewritten by frameworks, and validate both allowed and denied cases during testing.