Converged Bridge Access Management supports attribute-based policies, policies that apply to all resources and resource pattern-based policies. Patter-based policies can be assigned directly to users, access group and Service IDs, providing flexible control over resource access.

Resource pattern-based policies allow administrators to define a resource pattern (resource CRN) and apply one policy across multiple resources that match the specified pattern. Administrators can also configure a policy for an individual resource when more granular control is required.

Administrators can create, view, assign, update and validate resource pattern-based policies through the Assign Access Policy workflow.

During authorization, access evaluation includes the resource pattern-based policies associated with the user or the access group to which the user belongs. The OKTA FGA authorization engine evaluates these policies to determine whether access is allowed for resources that match the configured pattern.

A resource pattern identifies the resources that a policy applies to. When a wildcard (*) is included in part of the pattern, all values are accepted in that position.

Example resource pattern:

Example individual resource identifier:

Consider the following guidelines when creating pattern definitions to ensure values comply with the required validation rules and contain only supported characters:

The steps for assigning a pattern-based policy are the same for Users, Access Groups, and Service IDs. The only difference is the entry point used to access the entity.

Follow the steps below to assign a Resource based on patterns policy:

Once the policy is assigned, access is granted according to the configured resource pattern and authorization is evaluated against the matching resources.

Policies assigned to an access group can be edited when policy settings need to be updated. Changes to an access group policy can affect all users who inherit access through that access group.