Connector-authored policy

Composes deny rules authored by installed connectors into the platform decision, normalising their shape.

• Control id: connector_policy
• Shape: deny. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: token
• Phases: introspect

Policy data

This control owns no policy data row.

Reads

• context.rs_context.resource_type
• context.rs_context.scopes
• context.rs_context.tool_arguments

Emits

• deny
• deny_reasons
• rs_obligations
• subject_obligations

Reason codes

Code	Category	Entry point	Setting
connector_deny	aggregate	token	none

Implementation

Kind	Reference	Files	Role
rego_package	oauth.evaluations_ext	opa/policies/oauth/evaluations_ext.rego	decides