Skip to content

docs(access-rules): clarify the purpose of ATTRIBUTES - #104

Open
Martin187187 wants to merge 1 commit into
admin-shell-io:IDTA-01004-3-2_Workingfrom
Martin187187:issue-97
Open

Martin187187 wants to merge 1 commit into
admin-shell-io:IDTA-01004-3-2_Workingfrom
Martin187187:issue-97

Conversation

@Martin187187

@Martin187187 Martin187187 commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

Summary

This PR clarifies the purpose of the ATTRIBUTES section without changing the access-rule model.

Changes

  • Explains that the explicit attribute list communicates required subject claims to the PIP or token issuer without requiring it to parse the FORMULA.
  • Clarifies that server-provided GLOBAL operands and model REFERENCE operands may be used directly in a formula without being repeated in ATTRIBUTES.
  • Keeps ATTRIBUTES, DEFATTRIBUTES, USEATTRIBUTES, GLOBAL(ANONYMOUS), and the existing grammar and JSON Schema unchanged.

Validation

  • python tools/validate_spec_artifacts.py
  • python -m unittest discover -s tests/query

Closes #97

@Martin187187 Martin187187 changed the title docs(access-rules): explain attribute list purpose (#97) docs(access-rules): clarify the purpose of ATTRIBUTES Sep 3, 2026
@Martin187187
Martin187187 marked this pull request as ready for review September 3, 2026 09:23
@Martin187187

Copy link
Copy Markdown
Collaborator Author

decision by Security TF: GLOBAL and CLAIM have to be referenced in Attribute List.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant