Policy scope

Customer sets the floor, account narrows

Policy scope Customer sets the floor, account narrows 01 / Policy rows 02 / Resolution 03 / Rule 04 / Effective set 05 / Execution Customer policy row · 01 / Policy rows · customerId only Customer policy row customerId only Account policy row · 01 / Policy rows · accountId only Account policy row accountId only Policy resolution · 02 / Resolution · one rule per type Policy resolution one rule per type Whitelist · 03 / Rule · account subset Whitelist account subset Blacklist · 03 / Rule · union of both Blacklist union of both Other types · 03 / Rule · nearest row Other types nearest row Effective set · 04 / Effective set · read per request Effective set read per request Execution path · 05 / Execution · guardrail checks Execution path guardrail checks applies to every account applies on top whitelist subset of customer blacklist union of both other types account row wins per action Legend primary data data store data flow

Where a row applies

  • • A row with only customerId covers every account under that customer
  • • A row with accountId covers one account and resolves its customerId from the account
  • • createManagedAccount writes no policy rows, so a new account inherits the customer set

How the two rows meet

  • • Whitelist: the account list has to stay inside the customer list
  • • Blacklist: both lists apply together
  • • Everything else takes the account row when one exists