Resource type registry

Admits only resource and RAR intent types the platform knows, so that every admitted type can have policy hooked off it.

• Control id: resource_registry
• Shape: deny. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: register

Policy data

pbac.operator.controls.resource_registry

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-resource-registry.v1.json

Setting	Type	Default
resource.types	object	none in the schema
rar.types	object	none in the schema

Reads

• request.software_statement.granted_resources
• request.software_statement.resources

Emits

• deny
• reason
• deny_reasons

Reason codes

Code	Category	Entry point	Setting
invalid_resource_type	control	register	pbac.operator.controls.resource_registry#resource.types

Implementation

Kind	Reference	Files	Role
rego_inline	oauth.register	opa/policies/oauth/register.rego	decides
rego_package	oauth.client_entitlements	opa/policies/oauth/client_entitlements.rego	decides
rego_package	oauth.evaluations	opa/policies/oauth/evaluations.rego	decides
rego_reader	pbac.operator.controls.resource_registry	opa/policies/oauth/resource_registry.rego	reads