Denylist

Refuses a client, subject, redirect domain, software id or issuer that the operator has listed, at every entrypoint that can see it.

• Control id: denylist
• Shape: deny. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: token, authorize, register

Policy data

pbac.operator.controls.denylist

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-denylist.v1.json

Setting	Type	Default
client_ids	array of string	none in the schema
subjects	array of string	none in the schema
domains	array of string	none in the schema
software_ids	array of string	none in the schema
issuers	array of string	none in the schema

Reads

• context.client.client_id
• context.client.redirect_uri
• subject.sub

Emits

• deny
• reason
• deny_reasons

Reason codes

Code	Category	Entry point	Setting
client_denied	control	token	pbac.operator.controls.denylist#client_ids
client_denied	control	authorize	pbac.operator.controls.denylist#client_ids
subject_denied	control	token	pbac.operator.controls.denylist#subjects
subject_denied	control	authorize	pbac.operator.controls.denylist#subjects
domain_denied	control	authorize	pbac.operator.controls.denylist#domains
denylist:domain	control	register	pbac.operator.controls.denylist#domains
denylist:software_id	control	register	pbac.operator.controls.denylist#software_ids
denylist:issuer	control	register	pbac.operator.controls.denylist#issuers

Implementation

Kind	Reference	Files	Role
rego_package	oauth.denylist	opa/policies/oauth/denylist.rego	decides
rego_inline	oauth.token	opa/policies/oauth/token.rego	decides
rego_inline	oauth.authorize	opa/policies/oauth/authorize.rego	decides
rego_inline	oauth.register	opa/policies/oauth/register.rego	decides