Configure business policies

Define ABAC dimensions, foreign keys, and protection in the Business Entity manifest and dimension catalog before protection upload and governance certification. When a datasource does not use record-scoped ABAC, set accessControl.abac.applicability: notApplicable (with rationale) so certification does not expect scenario packs.

Prerequisites

Business Entity manifest with fieldMappings.attributes and top-level dimensions block
Configure business vocabulary started

Where it lives

Layer	Location
Catalog	Platform dimension catalog — `aifabrix dimension list\\|create`
Datasource bindings	`<datasourceKey>.json` → top-level `dimensions` → `dimensionBinding` per key
Protection	`integration/.protection/<datasourceKey>.yaml` — principal-to-dimension grants
Attributes	`fieldMappings.attributes` — normalized fields referenced by bindings

Not valid: fieldMappings.dimensions — use top-level dimensions only.

Builder MCP


Manifest sections	`datasource.dimensions`, `datasource.foreignKeys`, `datasource.protection`, `datasource.abac`
UI tab	Business Policies (`?tab=abac`)
Help topics	`section`, `evidencePatterns`, `repairRules`
Repair hooks	`fieldMappings`, protection upload (separate YAML)

Governance certification: verify-governance — see CLI workflow.

How to set

List or create catalog dimensions:

aifabrix dimension list
aifabrix dimension create --key customerRegion --display-name "Customer Region" --data-type string --value-type static
aifabrix dimension create --key ownerId --display-name "Record Owner" --data-type string --value-type dynamic

Add bindings on Business Entity JSON (top-level dimensions — each value is a dimension binding):

{
  "dimensions": {
    "customerRegion": {
      "type": "local",
      "field": "country",
      "enabled": true
    },
    "ownerId": {
      "type": "local",
      "field": "ownerEmail",
      "actor": "email",
      "operator": "eq",
      "enabled": true
    }
  }
}

Materialize fields in metadataSchema — bound fields must exist on normalized metadata (index where used for ABAC).
Align linked Business Entities — child entities inherit parent dimensions via foreign keys in protection (see Cross-system relationships).
Validate and upload datasource:

aifabrix validate <systemKey>
aifabrix upload <systemKey> --probe

Protection manifests — create YAML under integration/.protection/<datasourceKey>.yaml, then validate and upload:

aifabrix protection validate <datasourceKey>
aifabrix protection validate <datasourceKey> --warnings-as-errors
aifabrix protection upload <datasourceKey>

Full workflow and grant examples: Protection manifests and upload.

Governance test — scoped subject:

aifabrix verify-governance <systemKey> --subject-email scoped-user@example.com

Defaults and examples

Key	valueType	Use when
`customerRegion`	static	Regional visibility (catalog values)
`ownerId`	dynamic	Ownership from synced field
`department`	dynamic	Org-unit scoping
`dataClassification`	static	Sensitivity labels

Static dimensions: create catalog values with aifabrix dimension value create when needed.

Dimension bindings reference normalized fieldMappings.attributes fields — those fields must appear in metadataSchema.properties with correct types. The datasource key, displayName, systemKey, entityType, and top-level resourceType must remain valid while you add dimensions; primaryKey and indexed externalId are still required for recordStorage peers.

Validate

aifabrix dimension list
aifabrix validate <systemKey>
aifabrix protection validate <datasourceKey> --warnings-as-errors
aifabrix verify-governance <systemKey> --subject-email <scoped-user@example.com>

Common mistakes

Mistake	Fix
Dimensions under fieldMappings	Move to top-level `dimensions`
Catalog key typo	Match dimension create key exactly
Admin user for verify-governance	Scoped test subject
Missing identity sync	`identity sync -e <env>` after group mapping

Limits

Catalog → dataplane sync may lag after dimension create. Re-list before blaming validate errors on typos. Dimension bindings do not replace resourceType or entityType on the datasource root — they layer ABAC on top of normalized metadata that already passes record or document storage validate rules. Foreign-key inherited dimensions require parent datasources to expose the same catalog keys and indexed externalId fields used in protection scenarios. When verify-governance returns unexpected row counts, inspect protection show output before changing dimension bindings — the manifest may be correct while identity sync lagged.

Static dimensions require catalog values before protection upload — create values with dimension value create and re-list the catalog. Dynamic dimensions read from synced fields — ensure fieldMappings.attributes populates bound fields on every sync pass. Document displayName on the datasource helps operators correlate protection datasourceKey files with business entities during reviews. Run dimension list after every create — catalog lag is indistinguishable from typos in validate output until you re-list. Index metadata fields used in bindings before upload --probe — unindexed externalId or region fields produce governance passes that do not match production query behavior. Re-run datasource validate after editing dimensions — offline validate catches binding typos faster than protection upload.

Documentation Index