Trusted issuers

Rejects a software statement or subject token whose issuer is not on the operator's trusted list.

• Control id: trust
• Shape: deny. Segment bindings do not reach this control, because its Rego does not read settings through pbac.segments.settings.
• Entry points: token, register

Policy data

pbac.operator.controls.trust

• Role: operator
• Written by: operator
• Schema: src/main/resources/schemas/operator-trust.v1.json

Setting	Type	Default
trusted_issuers	array of string	none in the schema

Reads

• subject.token_issuer
• context.grant_type
• context.subject_token_type

Emits

• deny
• reason
• deny_reasons

Reason codes

Code	Category	Entry point	Setting
untrusted_issuer	control	register	pbac.operator.controls.trust#trusted_issuers
untrusted_token_issuer	control	token	pbac.operator.controls.trust#trusted_issuers

Implementation

Kind	Reference	Files	Role
rego_inline	oauth.register	opa/policies/oauth/register.rego	decides
rego_inline	oauth.token	opa/policies/oauth/token.rego	decides
rego_reader	pbac.operator.controls.trust	opa/policies/oauth/trust.rego	reads