Resource-Aware Policy (Dynamic Resource Dimensions)
The OPA policy engine now evaluates agent_class + capability + (resource dimension) triples instead of just agent_class + capability. Platform engineers define resource dimensions per-capability (env, tenant, service), bind allowed values to agent identities and packs, and OPA checks every request against those bindings at runtime.
What's included
- 4 new DB tables — resource_dimensions, dimension_value_map, identity_resource_bindings, pack_resource_bindings
- 10 new API endpoints — dimension CRUD, identity/pack resource binding management
- OPA Rego extension — resource_allowed gate, dim_allowed helper, resource_violations set
- Admin UI — dimension modals on capabilities, binding modals on agent classes and packs, resource violation display in approvals
- Audit — resource_check captured in every capability request audit event, filterable via resource_violation=true
- 47 new tests — 13 backend integration, 12 OPA Rego, 2 merge_bindings, 3 Playwright E2E, 7 UI test case specs