Subject restrictions

Denies a named subject specific resource types or actions.

• Control id: subject_restrictions
• Shape: deny. The own row and every matching binding union.
• Entry points: token, authorize

Policy data

pbac.operator.controls.subject_restrictions

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-subject-restrictions.v1.json

Setting	Type	Default

Reads

• subject.sub

Emits

• deny_reasons

Reason codes

This control emits no reason code.

Implementation

Kind	Reference	Files	Role
rego_fragment	oauth.evaluations	opa/policies/oauth/evaluations.rego	decides