Operator read-only mode

Lets an operator put any gateway-fronted resource into read-only mode, denying every scope that mutates upstream state regardless of what the client was granted.

• Control id: resource_read_only
• Shape: deny. The own row and every matching binding union.
• Entry points: token
• Phases: introspect

Policy data

pbac.operator.controls.resource_read_only

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-resource-read-only.v1.json

Setting	Type	Default
resources	array of string	none in the schema
instances	object	none in the schema

pbac.controls.resource_read_only

• Role: projection
• Written by: platform

Setting	Type	Default

Reads

• action
• context
• context.rs_context.resource_id
• context.rs_context.resource_name
• context.rs_context.scopes

Emits

• deny

Reason codes

Code	Category	Entry point	Setting
resource_read_only	control	token	pbac.operator.controls.resource_read_only#resources
resource_read_only_mixed_scope	control	token	pbac.operator.controls.resource_read_only#resources

Implementation

Kind	Reference	Files	Role
rego_package	pbac.controls.resource_read_only	opa/policies/pbac/controls/resource_read_only.rego	decides
java	com.identos.pbac.gateway.connectors.ResourceAccessProjectionService	src/main/java/com/identos/pbac/gateway/connectors/ResourceAccessProjectionService.java	computes_fact