Cyborg Sample Policy

Warning

JSON formatted policy file is deprecated since Cyborg 5.0.0(Victoria). Use YAML formatted file. Use oslopolicy-convert-json-to-yaml tool to convert the existing JSON to YAML formatted policy file in backward compatible way.

The following is a sample cyborg policy file that has been auto-generated from default policy values in code. If you’re using the default policies, then the maintenance of this file is not necessary, and it should not be copied into a deployment. Doing so will result in duplicate policy definitions. It is here to help explain which policy operations protect specific cyborg APIs, but it is not suggested to copy and paste into a deployment unless you’re planning on providing a different policy for an operation that is not the default.

If you wish build a policy file, you can also use tox -e genpolicy to generate it.

The sample policy file can also be downloaded in file form.

# Legacy rule for cloud admin access
#"admin_api": "role:admin"

# Default rule for Project level admin APIs.
#"project_admin_api": "role:admin and project_id:%(project_id)s"

# Default rule for Project level non admin APIs.
#"project_member_api": "role:member and project_id:%(project_id)s"

# Default rule for Project level read only APIs.
#"project_reader_api": "role:reader and project_id:%(project_id)s"

# Default rule for Project Member or admin APIs.
#"project_member_or_admin": "rule:project_member_api or rule:admin_api"

# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or project_id:%(project_id)s"
# has been deprecated since W in favor of
# "project_member_or_admin":"rule:project_member_api or
# rule:admin_api".
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# WARNING: A rule name change has been identified.
#          This may be an artifact of new rules being
#          included which require legacy fallback
#          rules to ensure proper policy behavior.
#          Alternatively, this may just be an alias.
#          Please evaluate on a case by case basis
#          keeping in mind the format for aliased
#          rules is:
#          "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_member_or_admin"

# Default rule for Project reader or admin APIs.
#"project_reader_or_admin": "rule:project_reader_api or rule:admin_api"

# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or project_id:%(project_id)s"
# has been deprecated since W in favor of
# "project_reader_or_admin":"rule:project_reader_api or
# rule:admin_api".
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# WARNING: A rule name change has been identified.
#          This may be an artifact of new rules being
#          included which require legacy fallback
#          rules to ensure proper policy behavior.
#          Alternatively, this may just be an alias.
#          Please evaluate on a case by case basis
#          keeping in mind the format for aliased
#          rules is:
#          "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_reader_or_admin"

# Default rule for service-to-service APIs.
#"service_api": "role:service"

# Default rule for project manager APIs.
#"project_manager_api": "role:manager and project_id:%(project_id)s"

# Default rule for project manager or admin APIs.
#"project_manager_or_admin": "rule:project_manager_api or rule:admin_api"

# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or project_id:%(project_id)s"
# has been deprecated since W in favor of
# "project_manager_or_admin":"rule:project_manager_api or
# rule:admin_api".
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# WARNING: A rule name change has been identified.
#          This may be an artifact of new rules being
#          included which require legacy fallback
#          rules to ensure proper policy behavior.
#          Alternatively, this may just be an alias.
#          Please evaluate on a case by case basis
#          keeping in mind the format for aliased
#          rules is:
#          "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_manager_or_admin"

# Default rule for project member or service APIs.
#"project_member_or_service": "rule:project_member_api or rule:service_api"

# DEPRECATED
# "rule:admin_or_owner":"is_admin:True or project_id:%(project_id)s"
# has been deprecated since W in favor of
# "project_member_or_service":"rule:project_member_api or
# rule:service_api".
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# WARNING: A rule name change has been identified.
#          This may be an artifact of new rules being
#          included which require legacy fallback
#          rules to ensure proper policy behavior.
#          Alternatively, this may just be an alias.
#          Please evaluate on a case by case basis
#          keeping in mind the format for aliased
#          rules is:
#          "old_rule_name": "new_rule_name".
# "rule:admin_or_owner": "rule:project_member_or_service"

# DEPRECATED
# "public_api" has been deprecated since W.
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# legacy rule of Internal flag for public API routes
#"public_api": "is_public_api:True"

# DEPRECATED
# "allow" has been deprecated since W.
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# legacy rule: any access will be passed
#"allow": "@"

# DEPRECATED
# "deny" has been deprecated since W.
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# legacy rule: all access will be forbidden
#"deny": "!"

# DEPRECATED
# "default" has been deprecated since W.
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# Legacy rule for default rule
#"default": "rule:admin_or_owner"

# DEPRECATED
# "is_admin" has been deprecated since W.
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# Full read/write API access
#"is_admin": "rule:admin_api"

# DEPRECATED
# "admin_or_owner" has been deprecated since W.
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# Admin or owner API access
#"admin_or_owner": "is_admin:True or project_id:%(project_id)s"

# DEPRECATED
# "admin_or_user" has been deprecated since W.
# Cyborg API policies are introducing new default roles with
# scope_type capabilities. We will start to deprecate old policies
# from WALLABY release, and are going to ignore all the old policies
# silently from X release. Be sure to take these new defaults into
# consideration if you are relying on overrides in your deployment for
# the policy API.
# Admin or user API access
#"admin_or_user": "is_admin:True or user_id:%(user_id)s"

# Retrieve all device_profiles
# GET  /v2/device_profiles
# Intended scope(s): project
#"cyborg:device_profile:get_all": "rule:project_reader_or_admin"

# DEPRECATED
# "cyborg:device_profile:get_all":"rule:admin_or_owner" has been
# deprecated since W in favor of
# "cyborg:device_profile:get_all":"rule:project_reader_or_admin".
# request admin_or_owner rule is too strict for listing device_profile

# Retrieve a specific device_profile
# GET  /v2/device_profiles/{device_profiles_uuid}
# Intended scope(s): project
#"cyborg:device_profile:get_one": "rule:project_reader_or_admin"

# DEPRECATED
# "cyborg:device_profile:get_one":"rule:admin_or_owner" has been
# deprecated since W in favor of
# "cyborg:device_profile:get_one":"rule:project_reader_or_admin".
# request admin_or_owner rule is too strict for retrieving a
# device_profile

# Create a device_profile
# POST  /v2/device_profiles
# Intended scope(s): project
#"cyborg:device_profile:create": "rule:admin_api"

# DEPRECATED
# "cyborg:device_profile:create":"rule:is_admin" has been deprecated
# since W in favor of "cyborg:device_profile:create":"rule:admin_api".
# project_admin_or_owner is too permissive, require admin for creation

# Delete device_profile(s)
# DELETE  /v2/device_profiles/{device_profiles_uuid}
# DELETE  /v2/device_profiles?value={device_profile_name1}
# Intended scope(s): project
#"cyborg:device_profile:delete": "rule:admin_api"

# DEPRECATED
# "cyborg:device_profile:delete":"rule:is_admin" has been deprecated
# since W in favor of "cyborg:device_profile:delete":"rule:admin_api".
# device profiles are global resources, require admin for deletion

# Retrieve all accelerator requests
# GET  /v2/accelerator_requests
# Intended scope(s): project
#"cyborg:arq:get_all": "rule:project_reader_or_admin"

# DEPRECATED
# "cyborg:arq:get_all":"rule:admin_or_owner" has been deprecated since
# 2026.2 in favor of
# "cyborg:arq:get_all":"rule:project_reader_or_admin".
# rule:default (admin_or_owner) is replaced by project_reader_or_admin
# to grant readers explicit read-only access to their own ARQs

# Retrieve a specific accelerator request
# GET  /v2/accelerator_requests/{arqs_uuid}
# Intended scope(s): project
#"cyborg:arq:get_one": "rule:project_reader_or_admin"

# DEPRECATED
# "cyborg:arq:get_one":"rule:admin_or_owner" has been deprecated since
# 2026.2 in favor of
# "cyborg:arq:get_one":"rule:project_reader_or_admin".
# rule:default (admin_or_owner) is replaced by project_reader_or_admin
# to grant readers explicit read-only access to their own ARQs

# Create accelerator request records
# POST  /v2/accelerator_requests
# Intended scope(s): project
#"cyborg:arq:create": "rule:project_member_or_service"

# DEPRECATED
# "cyborg:arq:create":"rule:project_member_or_admin" has been
# deprecated since 2026.2 in favor of
# "cyborg:arq:create":"rule:project_member_or_service".
# rule:project_member_or_admin is replaced by
# project_member_or_service to additionally accept the service role
# for machine-to-machine APIs

# Delete accelerator request records
# DELETE  /v2/accelerator_requests
# Intended scope(s): project
#"cyborg:arq:delete": "rule:project_member_or_service"

# DEPRECATED
# "cyborg:arq:delete":"rule:admin_or_owner" has been deprecated since
# 2026.2 in favor of
# "cyborg:arq:delete":"rule:project_member_or_service".
# rule:default (admin_or_owner) is replaced by
# project_member_or_service to use modern personas

# Update accelerator request records
# PATCH  /v2/accelerator_requests
# Intended scope(s): project
#"cyborg:arq:update": "rule:project_member_or_service"

# DEPRECATED
# "cyborg:arq:update":"rule:admin_or_owner" has been deprecated since
# 2026.2 in favor of
# "cyborg:arq:update":"rule:project_member_or_service".
# rule:default (admin_or_owner) is replaced by
# project_member_or_service to use modern personas

# Retrieve all deployable records
# GET  /v2/deployables
# Intended scope(s): project
#"cyborg:deployable:get_all": "rule:project_manager_or_admin"

# DEPRECATED
# "cyborg:deployable:get_all":"rule:admin_api" has been deprecated
# since 2026.2 in favor of
# "cyborg:deployable:get_all":"rule:project_manager_or_admin".
# rule:admin_api is replaced by project_manager_or_admin to grant the
# manager persona read access to deployable inventory for capacity
# planning and troubleshooting

# Show deployable detail
# GET  /v2/deployables/{uuid}
# Intended scope(s): project
#"cyborg:deployable:get_one": "rule:project_manager_or_admin"

# DEPRECATED
# "cyborg:deployable:get_one":"rule:admin_api" has been deprecated
# since 2026.2 in favor of
# "cyborg:deployable:get_one":"rule:project_manager_or_admin".
# rule:admin_api is replaced by project_manager_or_admin to grant the
# manager persona read access to deployable inventory for capacity
# planning and troubleshooting

# Program a deployable (FPGA bitstream reprogramming)
# PATCH  /v2/deployables/{uuid}/program
# Intended scope(s): project
#"cyborg:deployable:program": "rule:admin_api"

# Retrieve all device records
# GET  /v2/devices
# Intended scope(s): project
#"cyborg:device:get_all": "rule:project_manager_or_admin"

# DEPRECATED
# "cyborg:device:get_all":"rule:admin_api" has been deprecated since
# 2026.2 in favor of
# "cyborg:device:get_all":"rule:project_manager_or_admin".
# rule:admin_api is replaced by project_manager_or_admin to grant the
# manager persona read access to hardware inventory for capacity
# planning and troubleshooting

# Show device detail
# GET  /v2/devices/{uuid}
# Intended scope(s): project
#"cyborg:device:get_one": "rule:project_manager_or_admin"

# DEPRECATED
# "cyborg:device:get_one":"rule:admin_api" has been deprecated since
# 2026.2 in favor of
# "cyborg:device:get_one":"rule:project_manager_or_admin".
# rule:admin_api is replaced by project_manager_or_admin to grant the
# manager persona read access to hardware inventory for capacity
# planning and troubleshooting

# Disable a device
# POST  /v2/devices/{uuid}/disable
# Intended scope(s): project
#"cyborg:device:disable": "rule:admin_api"

# Enable a device
# POST  /v2/devices/{uuid}/enable
# Intended scope(s): project
#"cyborg:device:enable": "rule:admin_api"

# Retrieve all attribute records
# GET  /v2/attributes
# Intended scope(s): project
#"cyborg:attribute:get_all": "rule:project_manager_or_admin"

# DEPRECATED
# "cyborg:attribute:get_all":"rule:admin_api" has been deprecated
# since 2026.2 in favor of
# "cyborg:attribute:get_all":"rule:project_manager_or_admin".
# rule:admin_api is replaced by project_manager_or_admin to grant the
# manager persona read access to accelerator capability metadata for
# capacity planning and troubleshooting

# Show attribute detail
# GET  /v2/attributes/{uuid}
# Intended scope(s): project
#"cyborg:attribute:get_one": "rule:project_manager_or_admin"

# DEPRECATED
# "cyborg:attribute:get_one":"rule:admin_api" has been deprecated
# since 2026.2 in favor of
# "cyborg:attribute:get_one":"rule:project_manager_or_admin".
# rule:admin_api is replaced by project_manager_or_admin to grant the
# manager persona read access to accelerator capability metadata for
# capacity planning and troubleshooting

# Create an attribute record
# POST  /v2/attributes
# Intended scope(s): project
#"cyborg:attribute:create": "rule:admin_api"

# Delete an attribute record
# DELETE  /v2/attributes/{uuid}
# Intended scope(s): project
#"cyborg:attribute:delete": "rule:admin_api"