Client entitlements

Resolves what a client may do — its grant types and granted resources — from the highest-precedence identity source that matches it.

• Control id: client_entitlements
• Shape: grant. The own row and every matching binding union.
• Entry points: token, authorize
• Phases: introspect

Policy data

pbac.operator.controls.client_entitlements

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-client-entitlements.v1.json

Setting	Type	Default
client_id.<client_id>.grant_types	array of string	none in the schema
client_id.<client_id>.granted_resources	array of object	none in the schema
software_id.<software_id>.grant_types	array of string	none in the schema
software_id.<software_id>.granted_resources	array of object	none in the schema

Reads

• context.client.client_id
• context.client.software_statement
• context.client.software_statement.sub
• context.client.registration_type
• context.grant_type
• resources
• context.rs_context.interface
• context.rs_context.resource_type
• context.rs_context.scopes
• context.token_granted_resources

Emits

• deny
• reason
• granted_resources

Reason codes

Code	Category	Entry point	Setting
grant_type_not_allowed	control	token	pbac.operator.controls.client_entitlements#client_id.<client_id>.grant_types
grant_type_not_allowed	control	authorize	pbac.operator.controls.client_entitlements#client_id.<client_id>.grant_types
interface_not_granted	control	introspect	pbac.operator.controls.client_entitlements#client_id.<client_id>.granted_resources[].interfaces

Implementation

Kind	Reference	Files	Role
rego_package	oauth.client_entitlements	opa/policies/oauth/client_entitlements.rego	decides