Add scope to resource entitlement config

[MarcusGoldschmidt]

Description

• Bug fix
• New feature

Useful links:

• Baton SDK coding guidelines
• New contributor guide

[github-actions]

🟡 Suggestion: The error message says is_scoped_to_resource but the config field is is_scope_to_resource. This mismatch will confuse users debugging evaluation failures.

Suggested change

	return nil, fmt.Errorf("exclusion_group.is_scope_to_resource evaluation failed: %w", err)

[github-actions]

Connector PR Review: Add scope to resource entitlement config

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Review mode: full
View review run

Review Summary

This PR adds a new is_scope_to_resource boolean field to the ExclusionGroupMapping config, upgrades baton-sdk from v0.9.15 to v0.9.16, and wires the new field through evaluation and proto construction. The SDK upgrade brings the underlying ScopeToResource proto field and syncer logic that appends resource IDs to exclusion group IDs for per-resource scoping. The connector changes are clean and well-tested; one minor error message typo was found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• pkg/bsql/exclusion_group.go:67 — Error message says is_scoped_to_resource but the config field name is is_scope_to_resource (typo mismatch).

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `pkg/bsql/exclusion_group.go`:
- Around line 67: The error message string says "exclusion_group.is_scoped_to_resource" but the YAML/JSON config field is named "is_scope_to_resource" (no "d"). Change the error message from "is_scoped_to_resource" to "is_scope_to_resource" to match the config field.

[github-actions]

No blocking issues found.