Blocked intents

Denies a RAR entry whose intent type an operator has listed as blocked.

• Control id: blocked_intents
• Shape: deny. The own row and every matching binding union.
• Entry points: token

Policy data

pbac.operator.controls.blocked_intents

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-blocked-intents.v1.json

Setting	Type	Default
blocked_intents	array of string	none in the schema

Reads

• resources
• resources[].properties

Emits

• deny_reasons

Reason codes

Code	Category	Entry point	Setting
blocked_intent	control	token	pbac.operator.controls.blocked_intents#blocked_intents

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.blocked_intents	opa/policies/pbac/controls/blocked_intents.rego	decides