Choose whether the Dataplane applies its additional Dimension ABAC enforcement checks, deploy the choice, and test allowed and denied subjects through the interfaces your solution uses.
The setting controls additional Connected System assignment, source-access and subscription-ownership checks. It does not replace role permissions, record protection, or the business bindings described in Dimensions and protection.
Prerequisites
- A compatible Builder, Controller and Dataplane installation with the supported setup option.
- Authority to change and redeploy the target installation.
- Completed baseline Dimension and Business Role onboarding.
- A known allowed subject, an unassigned subject, and a small test resource for each relevant interface.
- The previous enforcement choice recorded so an operator can restore it if necessary.
Configure the actual business bindings and grants first: Configure business policies and Protection manifests and upload. Enabling a switch does not create the missing grants.
Where it lives
Builder persists the selected setting for the Dataplane application. It materializes the same boolean into supported local runtime environments and generated deployment configuration. The setting is Dataplane-specific; it is not a general switch for every application on the host.
The running service uses the deployed value. A changed saved selection is not evidence that an already-running process has adopted it. Apply changes through the normal restart or redeployment boundary and inspect the resulting runtime configuration.
How to set
- Record the target controller, environment, installed versions and current effective enforcement choice. Identify the API and background processing roles that must receive the same setting.
- Persist an explicit choice through supported setup:
aifabrix setup --dimension-abac on
Use off only when disabling these additional checks is the approved choice:
aifabrix setup --dimension-abac off
- Follow the setup output and complete the normal Dataplane restart or redeployment for the installation. Verify that the setting reaches the API, worker and scheduler roles used by the environment.
- Check that onboarding remains ready and that the expected assignments, source access and subscriptions exist for your allowed subject.
- Run the positive and negative checks below. Resolve missing grants or incompatible components before expanding the rollout. Do not grant administrator privileges to make a denied test pass.
Defaults and examples
| Input | Result |
|---|---|
| No saved value, option omitted | Default off |
| Saved value, option omitted | Preserve the saved selection |
--dimension-abac on |
Persist explicit enabled selection |
--dimension-abac off |
Persist explicit disabled selection |
For example, an allowed sales user may access an assigned Connected System while an otherwise comparable unassigned user is refused. Test the actual capability or subscription path involved; a permitted catalog listing is not proof that every downstream operation is allowed.
An environment with this setting off still has existing record-level protection and RBAC. Record those controls separately in the test evidence so “off” is not mistaken for unrestricted business data.
Validate
First confirm installation and authentication context:
aifabrix status
aifabrix auth status
Then retain the effective runtime setting and the result of each subject-specific check. Verify at least one allowed action, one refused unassigned action, and the record-scope behavior relevant to your solution. Record the interface, subject, resource, environment and correlation reference without copying business data into the test report.
Repeat the check after a normal setup update to confirm that an omitted option preserves the choice. If a rollout must be reversed, restore the recorded previous value through setup, redeploy normally, and repeat the same bounded checks. Restoration is not permission to bypass a production policy.
Common mistakes
| Mistake | Correction |
|---|---|
| Saved selection treated as effective runtime state | Inspect after restart or redeployment |
| One API check treated as all-interface certification | Test every interface used by the solution |
| Default off interpreted as disabling RBAC | Verify existing role and record controls separately |
| Administrator used for every test | Include ordinary allowed and unassigned subjects |
Limits
Compatibility and enforcement coverage depend on the installed component versions and execution path. A successful setup or one allowed/denied pair does not certify the entire platform. Keep broader rollout behind your organization's governance acceptance and recheck after changes to assignments, protection or deployment topology.