AbacPolicies
Attribute-based access rules — the layer that narrows what a role can reach, down to individual records.
Create an ABAC policy
Creates a policy that restricts access to individual records. A deny always wins: if any policy denies a request it is denied, whatever else allows it, and priority only orders the list on screen. A denial with no narrowing conditions is refused, because it would match every request and lock the tenant out of its own data. Requires `abac-policy.create`.
List ABAC policies
Returns the tenant's policies with their effect, conditions and state. Requires `abac-policy.read`.
Get an ABAC policy
Returns one policy: what it denies, to whom, and under which condition. Requires `abac-policy.read`.
Update an ABAC policy
Changes a policy's effect, conditions or state. Takes effect on the next request — policies are evaluated per request, not cached into the caller's token. Requires `abac-policy.update`.
Delete an ABAC policy
Soft-deletes a policy, which stops it denying anything. It can be restored. Requires `abac-policy.delete`.
Restore a deleted ABAC policy
Reinstates a soft-deleted policy. It begins denying again on the next request. Requires `abac-policy.restore`.
List a policy's recent decisions
Returns the requests this policy recently decided, so you can confirm it is catching what you intended before you rely on it. Requires `abac-policy.read-matches`.