Skip to main content
This page tracks capabilities that are documented ahead of enforcement. Authorization rules that depend on a not-yet-shipped capability fail closed (deny) until it lands—so use the “available today” alternatives noted below in the meantime.
This is a living page. If something here is blocking you, tell us—prioritization is demand-driven.

​
Planned

​
Subject-tag attribute matching (ABAC)

Status: planned — not yet enforced. Today the engine loads a resource’s tags into the evaluation context (exposed as a top-level tags map and tagList, usable in role-permission and resource-policy conditions). It does not load a subject’s tags, so conditions that reference subject.tags.* are always undefined and never grant. See Tag-Based Access Control. Planned: load the acting subject’s tags during evaluation and expose them (e.g. subject.tags.*) so subject↔resource tag matching works as documented. Available today for attribute-based rules: resource-side tag conditions, subject.meta.* attributes, resource policies, and resource ownership.

​
Resource attributes in conditions

Status: planned — not yet enforced. The resource binding in a json-logic condition currently exposes id, externalResourceId, resourceTypeId, resourceType, ownerScopeId, and displayName only. Fields such as resource.createdBy, resource.ownerId, and custom resource.meta.* are not available, so conditions referencing them never grant. Planned: expose additional resource attributes (e.g. createdBy, createdAt, custom metadata) in the condition context. Available today: resource tags (top-level tags / tagList) for classification, and resource ownership (owns(subject, resource, role)) for owner-based access.