<html><head><title></title></head><body><!-- rte-version 0.2 9947551637294008b77bce25eb683dac --><div class="rte-style-maintainer rte-pre-wrap" style="font-family: Arial, "BB.Proportional"; white-space: pre-wrap; font-size: small; color: rgb(0, 0, 0);" data-color="global-default" bbg-color="default" data-bb-font-size="medium" bbg-font-size="medium">I'm not sure that 'create' is an action you can do *to* a resource, since the resource you're thinking of doesn't yet exist. But I can see how that's debatable, and a good thought exercise.<div><br></div><div>On my environment, folks would probably model it differently and the resource would be *the API that creates loans*, and the action 'invoke' or something. The API is obviously a thing that exists prior to the future loan, and that has some unique identifier. Then the policies and evaluations become things like 'can user A invoke the loan creation API with an amount greater than X?' ...<br><br><div class="rte-style-maintainer" style="font-size: small; font-family: "Courier New", Courier, "BB.FixedWidth"; color: rgb(0, 0, 0);" data-color="global-default" bbg-color="default" data-bb-font-size="medium" bbg-font-size="medium"><div><div class="bbg-rte-fold-content" data-header="From: openid-specs-authzen@lists.openid.net At: 05/08/25 06:35:03 UTC-4:00" data-digest="From: openid-specs-authzen@lists.openid.net At: 05/08/25 06:35:03 UTC-4:00" style=""><div class="bbg-rte-fold-summary">From: openid-specs-authzen@lists.openid.net At: 05/08/25 06:35:03 UTC-4:00</div>To: <a spellcheck="false" bbg-destination="mailto:openid-specs-authzen@lists.openid.net" href="mailto:openid-specs-authzen@lists.openid.net"> openid-specs-authzen@lists.openid.net</a><br>Cc: <a spellcheck="false" bbg-destination="mailto:david.brossard@gmail.com" href="mailto:david.brossard@gmail.com"> david.brossard@gmail.com</a><br>Subject: [Openid-specs-authzen] A question on resource identifiers for resources that do not exist yet</div><br></div><div class="rte-internet-block-wrapper" data-blocked-bgimage="initial" style="background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; color: black; font-family: Arial, "BB.Proportional"; font-size: small; white-space: normal;"><div class="rte-internet-block"><blockquote><div dir="ltr"><div>Hi all,<br></div><div><br></div><div>Interesting use case from EIC: I want to write a policy that determines how a loan-to-be can be created.</div><div><br></div><div>Managers can create a loan for a customer in their region up to their max allowed amount for the employee (and/or customer).</div><div><br></div><div>The request would then be:</div><div><ul><li>Can Alice the employee create loan with amount 1234?</li></ul>In this type of request, because the loan hasn't been created we do not have a loan ID or resource ID. But, because AuthZEN makes the resource ID mandatory in the evaluation API, what approach do we want to recommend?</div><div><br></div><div>David </div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"></div></div> <div style="width: 500px;font-style: oblique;margin: 14px;margin-left: 0px;padding-top: 4px;border-top: 1px dotted black;"></div> <pre>--
Openid-specs-authzen mailing list
Openid-specs-authzen@lists.openid.net
https://lists.openid.net/mailman/listinfo/openid-specs-authzen
</pre> </blockquote><br></div></div></div></div></div></body></html>