From 9708ddab6f55a1d6b3ae48c4735edd9646c1a257 Mon Sep 17 00:00:00 2001 From: Martin Stemmer <52048213+Martin187187@users.noreply.github.com> Date: Thu, 3 Sep 2026 10:32:01 +0200 Subject: [PATCH] docs(access-rules): explain attribute list purpose (#97) --- .../IDTA-01004/modules/ROOT/pages/access-rule-model.adoc | 2 +- documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc b/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc index c3e9eb2..3ae5641 100644 --- a/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc +++ b/documentation/IDTA-01004/modules/ROOT/pages/access-rule-model.adoc @@ -255,7 +255,7 @@ Table <> describes the details of . |Description |ATTRIBUTES: -| List of ABAC attributes that the access control list depends on. The list contains definitions for individual attributes or pre-defined attribute groups introduced with DEFATTRIBUTES. Attributes are described in <>. +| List of ABAC attributes that the access control list depends on. The list contains definitions for individual attributes or pre-defined attribute groups introduced with DEFATTRIBUTES. Attributes are described in <>. The explicit list communicates which subject attributes an ACL requires, allowing the PIP or token issuer to determine the required claims without parsing the FORMULA. It is not a declaration list for every operand: server-provided GLOBAL operands and model REFERENCE operands may be used directly in the FORMULA without being repeated in ATTRIBUTES. |RIGHTS: | Enumeration of access rights subject to this access control list. Table <> describes the possible access rights, their semantics, and how they apply to the interface operations defined by the AAS API xref:bibliography.adoc#bib2[[2\]]. diff --git a/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc b/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc index 131af76..83414cb 100644 --- a/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc +++ b/documentation/IDTA-01004/modules/ROOT/pages/changelog.adoc @@ -19,6 +19,7 @@ Bugfixes: Minor Changes: +* Clarified that ATTRIBUTES communicates required subject claims to the PIP or token issuer without declaring every GLOBAL or REFERENCE operand used by a FORMULA [#97](https://github.com/admin-shell-io/aas-specs-security/issues/97). * Improved documentation of access rule examples * new access rule examples for DPP related rules, access rule 10 updated to better reflect the purpose