Sensitive capability opt-in

Denies operations a connector has named as sensitive — creating a public sharing link, inviting someone outside the tenant, posting into an external chat — until an operator enables that capability for that resource.

• Control id: capability_optin
• Shape: deny. The own row and every matching binding union.
• Entry points: token
• Phases: introspect

Policy data

pbac.operator.controls.capability_optin

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-capability-optin.v1.json

Setting	Type	Default
resources	object	none in the schema

Reads

• context
• context.rs_context.capability
• context.rs_context.resource_name

Emits

• deny

Reason codes

Code	Category	Entry point	Setting
capability_not_enabled	control	token	pbac.operator.controls.capability_optin#resources

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.capability_optin	opa/policies/pbac/controls/capability_optin.rego	decides
java	com.identos.pbac.gateway.service.GatewayIntrospectClient	src/main/java/com/identos/pbac/gateway/service/GatewayIntrospectClient.java	computes_fact