Implement Keycloak fine-grained authorization with UMA 2.0 and policy evaluation API

Steps

1. Enable Authorization Services on the Keycloak client; create resource types, resource instances, and scopes in the Authorization tab of the client configuration
2. Define policies (role-based, attribute-based, JavaScript, or composite) and create permissions linking resources/scopes to policies in the Keycloak Authorization Services UI or via the Protection API
3. From the resource server, use the Keycloak Policy Enforcer (keycloak-policy-enforcer adapter or equivalent) to intercept requests and call the token introspection/RPT endpoint
4. To evaluate permissions programmatically, POST to /realms/{realm}/protocol/openid-connect/token with grant_type urn:ietf:params:oauth:grant-type:uma-ticket, audience (client_id), and the permission claim ({resource}#{scope})
5. The AS returns an RPT (Requesting Party Token) — a JWT containing the permissions grant; verify the RPT locally by checking its permissions array for the requested resource and scope
6. Use the Policy Evaluation UI (Realm > Clients > Authorization > Evaluate) for debugging; it shows which policies matched, which permissions were granted, and the evaluation decision