Software statement validation

Requires a software statement at registration when the operator demands one, and requires any statement presented to declare its grant types and resources explicitly.

• Control id: software_statement_validation
• Shape: deny. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: register

Policy data

pbac.operator.controls.software_statement_validation

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-software-statement-validation.v1.json

Setting	Type	Default
require_software_statement	boolean	none in the schema

Reads

• request.software_statement
• request.software_statement.iss
• request.software_statement.grant_types
• request.software_statement.granted_resources

Emits

• deny
• reason
• deny_reasons

Reason codes

Code	Category	Entry point	Setting
missing_software_statement	control	register	pbac.operator.controls.software_statement_validation#require_software_statement
missing_explicit_declarations:grant_types	invariant	register	none
missing_explicit_declarations:resource_declarations	invariant	register	none

Implementation

Kind	Reference	Files	Role
rego_package	oauth.software_statement	opa/policies/oauth/software_statement.rego	decides
rego_inline	oauth.register	opa/policies/oauth/register.rego	decides