Skip to main content

Resources

Resources are the things you want to protect: documents, dashboards, API endpoints, database records, or anything else.

Resource types​

Before creating resources, define a resource type. A resource type is a blueprint that specifies:

  • Name: The category (e.g., document, dashboard, contact)
  • Actions: What can be done with this type (e.g., read, write, delete, share)
  • Attribute definitions: Expected attributes on resources of this type (optional)

Example resource type:

{
  "name": "document",
  "actions": ["read", "write", "delete", "share"],
  "attribute_definitions": [
    { "key": "classification", "type": "string" },
    { "key": "department", "type": "string" }
  ]
}

When you define attribute definitions on a resource type, the console auto-populates a dropdown when editing resources of that type and when building ABAC conditions.

Resources​

A resource is a specific instance of a resource type: Engineering Wiki is a resource of type document, invoice-8821 is a resource of type invoice. Resources can be referenced by UUID or by type + name; name-based lookup avoids hardcoding IDs in your code.

Resource attributes in conditions​

Resource attributes can be used in ABAC conditions to create fine-grained policies: for example, matching only resources where classification equals confidential, or comparing the resource's department against the subject's department.

Attributes stored on a resource are automatically included when Vengtoo evaluates an access request for it. You can also pass attributes in the request body for values that aren't stored in Vengtoo, but stored values win on conflict: a request cannot override an attribute already set on the resource in the control plane. See the Context & Trust Model for the full precedence order.

Last updated on