You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat(docs): document Resource Mapping Groups and FQN format (#350)
## Summary
- Add Resource Mapping Groups section to the
[resource_mappings](https://opentdf.io/components/policy/resource_mappings)
page
- Document the FQN format (`https://<namespace>/resm/<group-name>`)
- Show CLI usage for creating groups and assigning mappings
- Explain usage of group FQNs as synonym dictionary identifiers
This gap was identified when the FQN format could not be found in any
documentation or CLI output, requiring engineers to read source code to
discover it.
## Test plan
- [ ] `npm run build` passes
- [ ] Surge preview renders the updated page correctly
- [ ] Content reviewed for accuracy against source code
(`lib/identifier/resource_mapping_group.go`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Expanded the Resource Mappings guide to cover the optional `group`
field and clarified the “Examples” section structure.
* Added a new “Resource Mapping Groups” section, including group
composition details and the required FQN format (with lowercase
normalization) and its URL pattern.
* Included CLI walkthroughs for creating groups and assigning mappings
(including referencing by group id), plus a note about current
listing/get behavior for group FQNs.
* Documented how groups can be used as synonym dictionaries for
database-backed FQN resolution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Copy file name to clipboardExpand all lines: docs/components/policy/resource_mappings.md
+57-3Lines changed: 57 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,11 +6,65 @@ A Resource Mapping contains:
6
6
7
7
1. An associated `attribute value`.
8
8
2. A set of related `terms`.
9
+
3. An optional `group` (see [Resource Mapping Groups](#resource-mapping-groups) below).
9
10
10
11
The primary consumer of a Resource Mapping is a Policy Decision Point (PDP), which processes data, applies logic using the known terms, and relies on them to map the data to Attribute Values. By mapping a set of terms to a given attribute value, a Policy Enforcement Point (PEP) can properly apply the TDF to the resource data using the appropriate attribute values.
11
12
12
-
# Examples
13
+
##Examples
13
14
14
-
Alice is a system administrator. She defines an Attribute definition called color with values like red, green, blue, purple, etc. For the Attribute Value `https://demo.com/attr/color/value/purple'`, she would define a Resource Mapping for processing data that may involve terms like `indigo`, `lilac`, `plum`, or `lavender`.
15
+
Alex is a system administrator. They define an Attribute definition called color with values like red, green, blue, purple, etc. For the Attribute Value `https://demo.com/attr/color/value/purple`, they would define a Resource Mapping for processing data that may involve terms like `indigo`, `lilac`, `plum`, or `lavender`.
15
16
16
-
Bob is a system administrator in the US Department of Defense (DoD). Bob defines a hierarchical attribute called classification with values of `topsecret`, `secret`, `confidential`, and `unclassified`. He needs to create a resource mapping that defines a normalization of the various short forms and acronyms that map to each of these classification levels. For the `topsecret` attribute value, he might include terms like `ts`, `top secret`, and `top-secret`. Whereas for unclassified he might include `u`, `uc`, or other variations.
17
+
Beth is a system administrator in the US Department of Defense (DoD). Beth defines a hierarchical attribute called classification with values of `topsecret`, `secret`, `confidential`, and `unclassified`. She needs to create a resource mapping that defines a normalization of the various short forms and acronyms that map to each of these classification levels. For the `topsecret` attribute value, she might include terms like `ts`, `top secret`, and `top-secret`. Whereas for unclassified she might include `u`, `uc`, or other variations.
18
+
19
+
## Resource Mapping Groups
20
+
21
+
Resource Mapping Groups organize multiple Resource Mappings into logical collections under a [Namespace](./attributes.md#namespaces). Groups allow you to manage sets of related mappings together, which is useful when resources share common access controls or need to be managed as a unit.
22
+
23
+
A Resource Mapping Group contains:
24
+
25
+
1. A **name** identifying the group.
26
+
2. A **namespace** that the group belongs to.
27
+
3. A **Fully Qualified Name (FQN)** derived from the namespace and group name.
28
+
29
+
### FQN Format
30
+
31
+
Each Resource Mapping Group has a unique FQN following this pattern:
32
+
33
+
```text
34
+
https://<namespace>/resm/<group-name>
35
+
```
36
+
37
+
For example, a group named `ntk` under the namespace `example.org` would have the FQN:
38
+
39
+
```text
40
+
https://example.org/resm/ntk
41
+
```
42
+
43
+
Like other FQN'd objects in the platform, Resource Mapping Group FQNs are normalized to lower case.
44
+
45
+
:::note FQN visibility in the CLI
46
+
The `otdfctl` CLI does not currently display the FQN when listing or getting Resource Mapping Groups. To determine a group's FQN, construct it from the namespace and group name using the format above.
47
+
:::
48
+
49
+
### Creating a Group and Assigning Mappings
50
+
51
+
Groups are created under a namespace, and individual Resource Mappings can be assigned to a group at creation or update time. Building on Beth's classification example from above:
52
+
53
+
```bash
54
+
# Create a resource mapping group for classification terms under Beth's namespace
55
+
otdfctl policy resource-mapping-groups create \
56
+
--namespace-id <bobs-namespace-id> \
57
+
--name classification
58
+
59
+
# Create a resource mapping for "topsecret" terms, assigned to the group
60
+
otdfctl policy resource-mappings create \
61
+
--attribute-value-id <topsecret-value-id> \
62
+
--terms "ts,top secret,top-secret" \
63
+
--group-id <classification-group-id>
64
+
```
65
+
66
+
This group's FQN would be `https://<bobs-namespace>/resm/classification`, and it can be referenced by that FQN to resolve all classification term mappings from the database.
67
+
68
+
### Using Groups as Synonym Dictionaries
69
+
70
+
A Resource Mapping Group's FQN can be used as a synonym dictionary identifier in systems that resolve term-to-attribute-value mappings. When referenced by FQN, the system retrieves all Resource Mappings within that group from the policy database, enabling database-backed synonym resolution rather than inline configuration.
0 commit comments