Constraint Policies
What this screen is for
A constraint policy is a named set of conditions that limits how a capability grant may be used: when, on which days and hours, how many times, how often, and whether only once. Policies are reusable, so several grants can reference the same one. This screen is your tenant's catalog of policies, where you create, edit and delete them and read their versions.
A policy restricts nothing on its own. It takes effect only through the grants pinned to one of its versions.
What must exist first
This screen is for tenants that compose authorization by hand. It is not offered to SIMPLE tenants: a SIMPLE tenant uses Internal Use Cases, which set up the conditions each use case needs.
Before you work here you need the permission to list constraint policies, which shows this screen. Creating, editing and deleting a policy are further permissions, each held separately.
Decisions you make here
Creating a policy
With the permission to create constraint policies, New constraint policy asks for a Name, which is required, an optional Description, and the conditions below. Every condition is optional, and the conditions you set apply together: each use must satisfy all of them.
The conditions
- Valid From and Valid Until: a grant under the policy works only inside this window, from the start up to, but not including, the end. You enter both in your display time zone, and either side can be left open.
- Schedule: tick Admit requests only on chosen days and hours, then choose the Days and the hours From and Until. A request is admitted from the start time up to, but not including, the end time. An end earlier than the start runs into the next day. Without a schedule the policy admits requests at any time.
- Max Usage: how many uses each grant under the policy is allowed. Every use the grant admits counts, including one whose operation then fails. The use that reaches the cap consumes the grant. Blank means unlimited.
- Rate Limit: how many uses per minute each grant is allowed, over each calendar minute. A burst across the change of minute can briefly reach twice the rate. Blank means no rate limit; 0 blocks every use.
- Revoke on use: single use. The first use a grant admits consumes it, whether or not that operation succeeds. It authorizes one operation, not one message.
Days and hours are read in the platform time zone, which the schedule names. It is one zone for the whole platform, set by a platform administrator. When it cannot be read, a grant with a schedule refuses every request.
Usage counts are kept per grant: two grants under the same policy each get their own allowance. A grant that carries several operations has one count for all of them. A use refused by a condition, the schedule included, counts nothing.
Opening a policy
Selecting a policy opens its detail beside the list, with the tabs Info, Used by, Versions and Activity. Info shows the policy's identifier, current version, description and conditions, and offers Edit and Delete.
Editing a policy, and its versions
With the permission to update constraint policies, Edit changes the name, description and conditions. Saving creates a new version: creating writes version 1 and every edit writes the next one. The Version column shows the current one.
An edit moves no grant. A grant keeps the version it was pinned to until it is re-pinned with Change version, offered on an exchange's grants step and in the exchange topology. When a grant moves from a version with no usage limit to one with a limit, the uses it made before do not count toward the new limit; between limited versions the count continues.
The Versions tab lists every version, oldest first, with when it was created and how many grants in force are pinned to it. Compare versions takes a version From and a version To and shows each field that differs.
Deleting a policy
With the permission to delete constraint policies, Delete removes a policy that no capability grant references. While one does, the server refuses and names the grants that hold it: revoke or re-pin those first. A deleted policy cannot be restored.
Seeing which grants use a policy
The Used by tab lists the capability grants that reference the policy and are in force or consumed. Each row names the grant's capabilities, marks a consumed grant consumed, and links its actor and its exchange context to their own screens. When more grants use the policy than the tab shows, it says how many of the total it lists.
Reviewing a policy's history
The Activity tab shows the changes made to the policy, such as its creation and each edit. View in Audit Log opens the Audit Log narrowed to the policy's changes.
How it relates to other screens
A policy is chosen when a grant is created, and a grant's version is changed on the exchange editor or the topology: