Provenantby IdentiQube
Sign in

Resources & naming

A resource is the thing an action targets — a free-form string you define; the engine enforces it by pattern matching.

Namespace as scheme:identifier, or use a URL:

vendor:acme            invoice:9001           marketplace:cloud
db:prod-orders         s3:exports             list:lifecycle
https://api.openai.com/v1/chat

Matching is glob-based (allowed/denied resources, policy match):

  • * matches any run of characters, including ., : and /.
  • Matching is case-insensitive and fully anchored (the whole string must match).
  • An empty allow-list means "any resource" (within the action-type scope); the deny-list wins when both match.

Best practices

Use a consistent scheme: prefix per resource class; encode sensitivity in the name (db:prod-* vs db:staging-*) so one policy can protect production; keep identifiers stable — they appear verbatim in the ledger and exports.