you provide context in the request and then a CEL expression is evaluated to determine whether the caveat is satisfied or not