ABAC policy decision engine

Design a policy decision engine for a cloud platform that must evaluate fine-grained ABAC policies (deny-by-default, attributes like resource tags, requester role, time of day, source IP, MFA state) on every API call, 1M authorization decisions/sec, p99 budget of 1ms, and policy changes must take effect within seconds across the fleet. Walk through where evaluation happens (central PDP vs distributed PEP), how policies and the data they need are distributed, how you keep decisions fast and correct, and the trade-off between centralized auditability and edge latency.