the configuration object
additional attributes that are passed to PDP
session object, from which most attributes come
0 on deny (for any reason, e.g. indeterminate), or non-null if permit.