Repository navigation
Conversation
Replace the "data_scientist1 tries to upload" step. That upload failed because the DataScientists group has no write permission at all, which is plain RBAC: no ABAC condition was involved, so it didn't demonstrate ABAC. The new flow pairs every denial with a success where only an attribute differs, which shows that the condition is what blocks access: - The same CSV is uploaded to public/ (no metadata) and to PII/ (contains_pii=true). data_scientist1 can read the public copy but is denied the PII copy by ABACDenyPIIData. Same user, repo and content; only the object's tag differs. - The super user changes the repo's env metadata from production to dev, and data_scientist1 is denied the same public file it just read, by ABACProductionRepos. Nothing about the user, policies or file changed; only the repo's label did. Setting env back to production restores access, showing that access follows the label. Also: - Add a "What is ABAC?" section explaining conditions on repository and object metadata, and what the demo walks through. - Fix the double slash in the storage namespace (s3://example//abac-repo) by stripping a trailing slash from storageNamespace. Tested end to end on lakeFS Enterprise 1.104.1 (02_lakefs_enterprise stack). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…ged PII folder name to private so it doesn't conflict with RBAC demo policies.
iddoavn
approved these changes
Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.