📄️ Blocked intents
Denies a RAR entry whose intent type an operator has listed as blocked.
📄️ Sensitive capability opt-in
Denies operations a connector has named as sensitive — creating a public sharing link, inviting someone outside the tenant, posting into an external chat — until an operator enables that capability for that resource.
📄️ Human approval (CIBA)
Requires human approval for a RAR intent matching an operator rule, by emitting an approval_required subject obligation that kicks the caller into the CIBA flow.
📄️ Client entitlements
Resolves what a client may do — its grant types and granted resources — from the highest-precedence identity source that matches it.
📄️ Connector-authored policy
Composes deny rules authored by installed connectors into the platform decision, normalising their shape.
📄️ Denylist
Refuses a client, subject, redirect domain, software id or issuer that the operator has listed, at every entrypoint that can see it.
📄️ DPoP proof requirement
Requires a valid DPoP proof at /token, for clients that registered for sender-constrained tokens and for any client the operator names.
📄️ File access control
Decides which files, documents, spaces or calendars a connector may return or mutate, by label, by container location, or by the resource's own id.
📄️ Gateway obligation enforcement
Carries out the obligations the PDP emits, and fails closed when it cannot.
📄️ IdP routing
Chooses which identity provider an authorization request is sent to.
📄️ JIT single-use tokens
Makes an issued token single-use for SPIFFE workloads: the AS revokes it at /introspect after the first successful check.
📄️ PKCE requirement
Requires a PKCE code challenge at /authorize — for every client, for public clients only, or for a named list.
📄️ Public client policy
Bounds what a dynamically-registered or CIMD client may ask for at REGISTRATION: which grant types, scopes, resource indicators and client authentication methods are permitted, and whether open registration is allowed at all. It does not decide what an already-registered client is entitled to — that is client_entitlements, scoped by a binding.
📄️ Operator read-only mode
Lets an operator put any gateway-fronted resource into read-only mode, denying every scope that mutates upstream state regardless of what the client was granted.
📄️ Resource type registry
Admits only resource and RAR intent types the platform knows, so that every admitted type can have policy hooked off it.
📄️ Software statement validation
Requires a software statement at registration when the operator demands one, and requires any statement presented to declare its grant types and resources explicitly.
📄️ SPIFFE workload identity
Admits SPIFFE-identified workloads from trusted domains only, and grants each one entitlements by its SPIFFE path.
📄️ Subject restrictions
Denies a named subject specific resource types or actions.
📄️ Token derivation limits
A token derived from another token — by introspection re-issue or by token exchange — may never carry more than the token it came from.
📄️ Token TTL override
Shortens the lifetime of an issued token for SPIFFE workloads. Composes as a minimum across every contributor, so it lowers a TTL and never raises one.
📄️ Trusted issuers
Rejects a software statement or subject token whose issuer is not on the operator's trusted list.
📄️ URI validation
Rejects a redirect or client URI that does not parse.