AbacQueryPolicy
Resolves terminal access conditions using attribute-based access control (ABAC).
Principal tags from the current context are converted into query conditions and appended to snapshot queries, whose resource tags are the tags system field, and to the queries of a dataset that binds tag columns (DatasetQueryModelProfile.tags): a string column holds one tag value per record and a string-array column several, and an empty string or array is a record without the tag. Other query models, and datasets that bind no tag, are unrestricted by this policy and do not resolve principal tags.
Matching rules
| Principal tags | Resource tags | Result |
|---|---|---|
wildcard (["*"]) | any | match |
["a", "b"] | ["a"] | match |
["a", "b"] | ["c"] | no match |
| any | key absent | match (public resource) |
| no tags | any | match |
The last two rows are the defaults; AbacQueryOptions tightens each.
Functions
Resolves the ABAC condition for the current context.
Resolves the principal's ABAC tags from the current context.