File access control

Decides which files, documents, spaces or calendars a connector may return or mutate, by label, by container location, or by the resource's own id.

• Control id: file_access
• Shape: obligation. The own row and every matching binding union.
• Entry points: token
• Phases: introspect
• Enforced at: gateway

Policy data

pbac.operator.controls.file_access

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-file-access.v1.json

Setting	Type	Default
governed	object	none in the schema
sources[].type	string	none in the schema
sources[].required	array of string	none in the schema
sources[].blocked	array of string	none in the schema
sources[].write_blocked	array of string	none in the schema
sources[].default	any JSON value	none in the schema
allow_containers	object	none in the schema

pbac.controls.file_access

• Role: projection
• Written by: connectors

Setting	Type	Default
projection[].mode	no schema for this row	none in the schema
projection[].id_arg	no schema for this row	none in the schema
projection[].read_scope	no schema for this row	none in the schema
projection[].write_scopes	no schema for this row	none in the schema
projection[].items_path	no schema for this row	none in the schema
projection[].api_base	no schema for this row	none in the schema
projection[].types	no schema for this row	none in the schema
projection[].create	no schema for this row	none in the schema
projection[].container	no schema for this row	none in the schema

Reads

• context.rs_context.resource_type
• context.rs_context.scopes
• context.rs_context.tool_arguments

Emits

• rs_obligations

Reason codes

Code	Category	Entry point	Setting
file_access:blocked_match	control	gateway	pbac.operator.controls.file_access#sources[].blocked
file_access:not_in_required	control	gateway	pbac.operator.controls.file_access#sources[].required
file_access:deny_all	mechanism	gateway	none

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.file_access	opa/policies/pbac/controls/file_access.rego	decides
java	com.identos.pbac.gateway.obligations.fileaccess.FileAccessGuard	src/main/java/com/identos/pbac/gateway/obligations/fileaccess/FileAccessGuard.java	enforces
java	com.identos.pbac.gateway.obligations.fileaccess.FileAccessFilter	src/main/java/com/identos/pbac/gateway/obligations/fileaccess/FileAccessFilter.java	enforces
java	com.identos.pbac.gateway.obligations.fileaccess.FileAccessPredicate	src/main/java/com/identos/pbac/gateway/obligations/fileaccess/FileAccessPredicate.java	decides