fix(docs): authorization deny precedence docs - #811
Conversation
|
Warning Review limit reached
Next review available in: 59 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (11)
📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The authorization docs described `effect: deny` as a global override that blocks a request whenever any matching binding denies it. The engine evaluates once per entitlement value and applies deny only within the entitlement it is bound to, so a user who belongs to both an allowed group and a denied group is allowed. The API reference went further and recommended deny as the mechanism for revoking access, which does not work when the grant comes from a different entitlement. Describe the aggregation rule as per-entitlement resolution followed by a union across entitlements, note that deny is scoped to its binding subject rather than to a person, and add a "Revoking access" section covering the supported way to remove access: remove the granting binding or narrow its scope. Applied in full to docs/ and v1.2.x. v1.1.x and v1.0.x receive the wording corrections only, without the new section or callout, to keep the archived versions structurally unchanged. v0.16.x and v0.17.x still carry the old text and are left for a separate decision.\ Signed-off-by: Mevan <mevan.karu@gmail.com>
3c0933b to
3d3247e
Compare
mevan-karu
changed the title
mevan-karu
changed the title
3 participants
$subject
Related Issues