Decrypt for custom actions

[mm192010]

Hi

I created custom actions, "full-permission", "print". In both cases i want to decrypt the file and PEP will take care of the actions. But is see that without "read" action in subject-mapping, decryption does not happen. Any way to change that behavior ?

Regards
Max

[marythought]

Hi Max,

Short answer: yes, this is by design — KAS rewrap (the call that gates decryption) is hardcoded to authorize against the read action. From service/kas/access/accessPdp.go:

var decryptAction = &policy.Action{
    Name: actions.ActionNameRead, // "read"
}

That action is what gets passed to GetDecision / GetDecisionMultiResource, so if read isn't mapped to the subject via a subject mapping, the rewrap request will be denied — regardless of which custom actions the subject does have.

The intended pattern for custom actions is:

• Include read on the subject mapping for any subject that should be able to decrypt.
• Include the custom actions (full-permission, print, etc.) alongside read.
• Your PEP enforces what the subject can do with the decrypted bytes based on those custom actions.

So KAS only answers "can this subject read these attributes?" — anything finer-grained (full vs. print-only, etc.) is the PEP's responsibility, after the rewrap has succeeded.

If your use case really needs decryption itself to be gated by a custom action instead of read, that would be worth raising as a separate feature discussion — but it isn't possible with the platform today.