Human approval (CIBA)

Requires human approval for a RAR intent matching an operator rule, by emitting an approval_required subject obligation that kicks the caller into the CIBA flow.

• Control id: ciba_approval
• Shape: obligation. The own row and every matching binding union.
• Entry points: token

Policy data

pbac.operator.controls.ciba_approval

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-ciba-approval.v1.json

Setting	Type	Default
obligations	array of object	none in the schema
approval_idp_selection	object	none in the schema

Reads

• resources
• resources[].type
• resources[].properties

Emits

• subject_obligations

Reason codes

This control emits no reason code.

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.ciba_approval	opa/policies/pbac/controls/ciba_approval.rego	decides
rego_reader	pbac.operator.controls.ciba_approval	opa/policies/oauth/evaluations.rego	reads