35 lines
731 B
YAML
35 lines
731 B
YAML
{
|
|
"apiVersion": "hub.example.com/v1alpha1",
|
|
"kind": "Policy",
|
|
"metadata": {
|
|
"name": "020 Project Scope Isolation",
|
|
"slug": "020-project-scope-isolation"
|
|
},
|
|
"spec": {
|
|
"priority": 20,
|
|
"description": "Require the token project claim, endpoint project and requested resource project to be identical.",
|
|
"match": {
|
|
"resourceTypes": [
|
|
"tool",
|
|
"resource",
|
|
"prompt"
|
|
]
|
|
},
|
|
"conditions": {
|
|
"allEqual": [
|
|
"claims.project",
|
|
"route.project",
|
|
"request.project"
|
|
],
|
|
"requiredClaims": [
|
|
"sub",
|
|
"aud",
|
|
"scope",
|
|
"project"
|
|
]
|
|
},
|
|
"decision": "allow_if_conditions",
|
|
"terminal": false
|
|
}
|
|
}
|