Authorization
Deciding who may read or change what, at service, entity and instance level — role checks, forwarded user context, and restrictions evaluated as query filters rather than after the fact.
Showing artifacts, examples and content with confirmed Node.js applicability. View All CAP
Overview
The development-time half of an AMS authorization model: it compiles the DCL policies the decision controller evaluates, and under ias authentication pushes them to the AMS server from the SAP Identity service binding.
Evaluates AMS authorization policies in the application process for users authenticated through SAP Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp, answering each privilege check as granted, denied or conditional, and filtering the resources a request reaches on the attribute conditions AMS computes. In a CAP project it also generates the base DCL policies for the roles the @requires and @restrict annotations already name.
Evaluates @requires and @restrict from the model at runtime, including instance-based restrictions expressed as where-clauses.
A Node.js coverage assessment has not been written. View all flavors
Translates Entra ID group claims and app roles into cds.User roles, so the model's @requires and @restrict annotations are evaluated against an Azure identity.
A Node.js coverage assessment has not been written. View all flavors
Artifacts
Seen working
Neither the package manifest nor the repository tree declares a licence.
Neither the package manifest nor the repository tree declares a licence.
Details
Coverage
For your agent
- Ref
capability:authorization- JSON
- /capabilities/authorization.json
- MCP
- Connecting an agent