Skip to main content

RBAC

Configure this policy as rbac. It uses roles from the resolved policy identity. It can also examine verdictan.data_sensitivity and PHI-like request text.

The gateway must authenticate the caller and resolve its identity before this policy runs. The RBAC evaluator does not use a raw X-User-Role header as a production role claim.

Phase and verdicts​

  • Phase: input
  • Verdicts: allow or block

Configuration​

pack:
  name: rbac-example-1
  version: "1.0.0"
  enabled: true

policies:
  chain:
    - rbac

policy:
  rbac:
    require_auth: true
    roles:
      analyst:
        allowed_tools:
          - search
          - summarize
          - report_*
        denied_tools:
          - dangerous_*
      admin:
        allowed_tools:
          - "*"
        denied_tools: []
    data_access:
      analyst:
        max_sensitivity: confidential
      admin:
        max_sensitivity: restricted
    minimum_necessary:
      enabled: true
      allowed_phi_roles:
        - clinician
        - admin

Supported fields​

FieldTypeDefaultNotes
deny_if_missingstring[][]Missing or empty listed headers cause rbac.missing_identity. This check is different from identity resolution.
require_authbooleanruntime default: trueA resolved policy identity is necessary. Set this field explicitly because the active lint schema shows a different default.
rolesobject{}Keys are role names matched against roles in the resolved policy identity. A configured role table blocks requests that have no resolved role.
roles.<role>.allowed_toolsstring[][]Supports specified names and * wildcards.
roles.<role>.denied_toolsstring[][]Deny rules override allow rules.
data_accessobject{}Role-specific limits for verdictan.data_sensitivity.
data_access.<role>.max_sensitivitystringpublicOne of public, internal, confidential, restricted.
minimum_necessary.enabledbooleanfalseEnables PHI gating based on message content.
minimum_necessary.allowed_phi_rolesstring[][]Roles allowed to continue when PHI-like content is detected.

What the policy checks​

  1. The gateway resolves the caller to a policy identity.
  2. require_auth: true blocks the request when that identity is not available.
  3. A configured roles table must match a minimum of one resolved role.
  4. Tool restrictions apply to names in request.tools[*].function.name or request.tools[*].name.
  5. A specified deny rule overrides an allow rule across the resolved roles.
  6. data_access compares verdictan.data_sensitivity with each applicable role limit.
  7. minimum_necessary checks messages[].content for PHI-like text.
  8. It blocks PHI-like text when no resolved role is in allowed_phi_roles.

If you configure deny_if_missing, the gateway also examines those raw request headers. Identity headers can contain ASCII letters, numbers, -, _, and .. Do not use this header-presence check as authentication proof.

Important behavior notes​

  • The RBAC evaluator gets roles from the resolved policy identity.
  • Raw X-User-Role values do not directly select a production role.
  • A role that has a specified deny pattern blocks the matching tool.
  • A tool must be allowed by a minimum of one resolved role.
  • require_auth: false can allow a request without identity only when no role rule must have a role.
  • HeaderSoft identity is for specified self-hosted development only. Hosted, connected, CJIS, and release deployments reject this unverified mode.

Minimal correct example​

policy:
  rbac:
    require_auth: true

Use the Identity and Access overview to configure the identity source that supplies roles.

Next steps​