Skip to content

Commit f08112f

Browse files
marythoughtclaude
andauthored
feat(docs): document Resource Mapping Groups and FQN format (#350)
## Summary - Add Resource Mapping Groups section to the [resource_mappings](https://opentdf.io/components/policy/resource_mappings) page - Document the FQN format (`https://<namespace>/resm/<group-name>`) - Show CLI usage for creating groups and assigning mappings - Explain usage of group FQNs as synonym dictionary identifiers This gap was identified when the FQN format could not be found in any documentation or CLI output, requiring engineers to read source code to discover it. ## Test plan - [ ] `npm run build` passes - [ ] Surge preview renders the updated page correctly - [ ] Content reviewed for accuracy against source code (`lib/identifier/resource_mapping_group.go`) 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Expanded the Resource Mappings guide to cover the optional `group` field and clarified the “Examples” section structure. * Added a new “Resource Mapping Groups” section, including group composition details and the required FQN format (with lowercase normalization) and its URL pattern. * Included CLI walkthroughs for creating groups and assigning mappings (including referencing by group id), plus a note about current listing/get behavior for group FQNs. * Documented how groups can be used as synonym dictionaries for database-backed FQN resolution. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent b398d42 commit f08112f

1 file changed

Lines changed: 57 additions & 3 deletions

File tree

docs/components/policy/resource_mappings.md

Lines changed: 57 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,65 @@ A Resource Mapping contains:
66

77
1. An associated `attribute value`.
88
2. A set of related `terms`.
9+
3. An optional `group` (see [Resource Mapping Groups](#resource-mapping-groups) below).
910

1011
The primary consumer of a Resource Mapping is a Policy Decision Point (PDP), which processes data, applies logic using the known terms, and relies on them to map the data to Attribute Values. By mapping a set of terms to a given attribute value, a Policy Enforcement Point (PEP) can properly apply the TDF to the resource data using the appropriate attribute values.
1112

12-
# Examples
13+
## Examples
1314

14-
Alice is a system administrator. She defines an Attribute definition called color with values like red, green, blue, purple, etc. For the Attribute Value `https://demo.com/attr/color/value/purple'`, she would define a Resource Mapping for processing data that may involve terms like `indigo`, `lilac`, `plum`, or `lavender`.
15+
Alex is a system administrator. They define an Attribute definition called color with values like red, green, blue, purple, etc. For the Attribute Value `https://demo.com/attr/color/value/purple`, they would define a Resource Mapping for processing data that may involve terms like `indigo`, `lilac`, `plum`, or `lavender`.
1516

16-
Bob is a system administrator in the US Department of Defense (DoD). Bob defines a hierarchical attribute called classification with values of `topsecret`, `secret`, `confidential`, and `unclassified`. He needs to create a resource mapping that defines a normalization of the various short forms and acronyms that map to each of these classification levels. For the `topsecret` attribute value, he might include terms like `ts`, `top secret`, and `top-secret`. Whereas for unclassified he might include `u`, `uc`, or other variations.
17+
Beth is a system administrator in the US Department of Defense (DoD). Beth defines a hierarchical attribute called classification with values of `topsecret`, `secret`, `confidential`, and `unclassified`. She needs to create a resource mapping that defines a normalization of the various short forms and acronyms that map to each of these classification levels. For the `topsecret` attribute value, she might include terms like `ts`, `top secret`, and `top-secret`. Whereas for unclassified she might include `u`, `uc`, or other variations.
18+
19+
## Resource Mapping Groups
20+
21+
Resource Mapping Groups organize multiple Resource Mappings into logical collections under a [Namespace](./attributes.md#namespaces). Groups allow you to manage sets of related mappings together, which is useful when resources share common access controls or need to be managed as a unit.
22+
23+
A Resource Mapping Group contains:
24+
25+
1. A **name** identifying the group.
26+
2. A **namespace** that the group belongs to.
27+
3. A **Fully Qualified Name (FQN)** derived from the namespace and group name.
28+
29+
### FQN Format
30+
31+
Each Resource Mapping Group has a unique FQN following this pattern:
32+
33+
```text
34+
https://<namespace>/resm/<group-name>
35+
```
36+
37+
For example, a group named `ntk` under the namespace `example.org` would have the FQN:
38+
39+
```text
40+
https://example.org/resm/ntk
41+
```
42+
43+
Like other FQN'd objects in the platform, Resource Mapping Group FQNs are normalized to lower case.
44+
45+
:::note FQN visibility in the CLI
46+
The `otdfctl` CLI does not currently display the FQN when listing or getting Resource Mapping Groups. To determine a group's FQN, construct it from the namespace and group name using the format above.
47+
:::
48+
49+
### Creating a Group and Assigning Mappings
50+
51+
Groups are created under a namespace, and individual Resource Mappings can be assigned to a group at creation or update time. Building on Beth's classification example from above:
52+
53+
```bash
54+
# Create a resource mapping group for classification terms under Beth's namespace
55+
otdfctl policy resource-mapping-groups create \
56+
--namespace-id <bobs-namespace-id> \
57+
--name classification
58+
59+
# Create a resource mapping for "topsecret" terms, assigned to the group
60+
otdfctl policy resource-mappings create \
61+
--attribute-value-id <topsecret-value-id> \
62+
--terms "ts,top secret,top-secret" \
63+
--group-id <classification-group-id>
64+
```
65+
66+
This group's FQN would be `https://<bobs-namespace>/resm/classification`, and it can be referenced by that FQN to resolve all classification term mappings from the database.
67+
68+
### Using Groups as Synonym Dictionaries
69+
70+
A Resource Mapping Group's FQN can be used as a synonym dictionary identifier in systems that resolve term-to-attribute-value mappings. When referenced by FQN, the system retrieves all Resource Mappings within that group from the policy database, enabling database-backed synonym resolution rather than inline configuration.

0 commit comments

Comments
 (0)