policy: add admin:PolicyName condition key

[harshavardhana]

Policy admin actions (admin:CreatePolicy, admin:DeletePolicy, admin:GetPolicy) take no resource. A principal that may manage policies may therefore manage every policy, including its own, and can widen itself.

The admin:PolicyName condition key names the policy the action works on, so a statement can limit those actions to a set of policies:

"Condition": {"StringLike": {"admin:PolicyName": ["app-*"]}}

The server fills PolicyName in for the policy admin handlers (AIStor change follows once this merges). Orb uses it to let its apiserver manage only the orb-u-* and orb-system policies.

Summary by CodeRabbit

• New Features
  • Access policies can now use admin policy names as condition keys. Rules can match policy names using patterns or exact values, enabling name-specific access decisions for admin policy operations. Admin policy names are also recognized consistently when evaluating these conditions.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8c934e95-95ef-401e-8205-a73004992fe8

📥 Commits

Reviewing files that changed from the base of the PR and between 1d86620 and 360a546.

📒 Files selected for processing (2)

• policy/action.go
• policy/admin_policy_name_test.go

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ef416d13-0b8b-4f2e-9dd0-6da7874e8e04

📥 Commits

Reviewing files that changed from the base of the PR and between 62d805e and 1d86620.

📒 Files selected for processing (2)

• policy/admin_policy_name_test.go
• policy/condition/keyname.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds admin:PolicyName as a supported condition key and adds tests for name-based policy matching and Deny precedence.

Changes

Admin Policy Name Condition

Layer / File(s)	Summary
Register the admin policy-name key policy/condition/keyname.go	Adds admin to the prefixes stripped by KeyName.Name. Defines AdminPolicyName and adds it to the supported condition-key lists.
Test policy-name conditions policy/admin_policy_name_test.go	Tests StringLike matching for policy names across admin actions. Also tests that a name-specific StringEquals Deny overrides an unconditional CreatePolicy Allow for consoleAdmin.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 1d866

No actionable issue remains in this change after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 1d866

A name-based condition could restrict policy administration, but it protects requests only when the server supplies the actual target policy name. A name-specific Deny could be ineffective if used before that integration is in place.

Retained concerns

• Medium · security · inferred: A name-specific Deny may not constrain an otherwise allowed policy-admin action unless the runtime supplies PolicyName from the authoritative target. The tests supply that value directly; production wiring remains unverified.

Security review details

Security Blast Radius

• inferred — If a principal already has an unconditional policy-admin Allow and relies on the new conditional Deny, an absent or incorrectly sourced PolicyName could leave policy creation outside the intended name restriction. Actual exposure depends on deployed policies and runtime integration, neither of which is established here.

Security Findings and Attack Paths

• inferred — The conditional attack path requires both a policy that otherwise permits the admin action and a runtime value that is absent or not bound to its actual target. The available evidence does not verify those prerequisites in production.

Trust Boundaries and Controls

• observed — The condition consumes a generic map supplied with authorization arguments; the tests confirm that a missing name does not satisfy their conditional Allow and that a populated, matching Deny takes precedence.

Hardening Proposals

• proposed — Before relying on name-scoped policy permissions, verify that every relevant admin handler supplies exactly the authoritative target name and that rollout prevents conditional Deny policies from being relied upon where that value is unavailable.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the primary change: adding the admin:PolicyName condition key.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit reads the policy key
“Admin names now match,” says she
StringLike checks each name in turn
A scoped Deny takes its concern
She hops away beneath the moon
With policy tests complete so soon}

_{Comment @coderabbitai help to get the list of available commands.}