Explain the internal working of a Policy Decision Point evaluating a request?

Internally, the PDP is really two cooperating sub-components: the Policy Engine (PE), which does the actual reasoning, and the Policy Administrator (PA), which turns that reasoning into an executable outcome.

When a request arrives, the PE gathers the relevant attributes: identity assurance level from the authentication event, device compliance status, the sensitivity classification of the target resource, and any contextual risk signals like location anomalies. It applies a trust algorithm, which can be purely rule-based, score-based with weighted signals, or a hybrid, to produce a decision along with a confidence level, not just a binary flag.

That decision is handed to the PA, which is responsible for the operational side: issuing a short-lived token or certificate, defining session expiry and allowed scope, and instructing the specific PEP(s) involved on exactly how to configure the session. The PA, not the PE, is what actually communicates with enforcement infrastructure.