Configure dimensional access

Replace the placeholders with values from your own authorized scope before copying this prompt into an MCP client.

Inputs

• {{workspace_id}} Stable workspace ID.
• {{application_id}} Stable application ID.
• {{subject_id}} Directory subject whose direct tag maps may be replaced.
• {{read_tags}} Complete desired dimension-to-read-tags map.
• {{write_tags}} Complete desired dimension-to-write-tags map.
• {{request_key}} Stable idempotency key for this exact change.

Prompt

In {{workspace_id}} / {{application_id}}, use read_v2_program with security.application.dimension-access.read for subjectId {{subject_id}}. Confirm the subject has the intended application role and record securityRevision.
Use security.application.dimension-tags.read to verify that each tag is present on active members of the dimension for the intended access kind. Read security.application.dimension-policy.active.read to identify the policy that will enforce the assignments.
Call set_v2_application_access with security.application.dimension-access.set, subjectId {{subject_id}}, readTags {{read_tags}}, writeTags {{write_tags}}, expectedSecurityRevision and idempotency_key {{request_key}}. Treat both maps as complete replacements.
Read the assignment back and use security.application.receipt.read with the same operation ID. Report the returned maps, active policy and security revision.
Stop on stale revision, unknown tag, missing grant or unavailable policy evidence. Policy activation is a separate reviewed action.

Example inputs

In the disposable Operating Data Cube, use a test subject with a direct Reader grant. Create and attach read tag DocsPointARead to Entity member PointA and read tag DocsPointBRead to PointB. Seed a value at both points before activating the reviewed test policy.

{
  "subjectId": "reader",
  "readTags": {"Entity": ["DocsPointARead"]},
  "writeTags": {}
}

The example leaves untagged members in the other dimensions allowed and filters unauthorized rows. Save and activate the following policy separately in the disposable fixture. Use the current security revision for activation and again for the subsequent assignment.

{
  "acrossDimensions": "every_protected",
  "withinDimension": "any_tag",
  "untaggedMember": "allow",
  "untaggedDenyPrecedence": "absolute",
  "memberTagCardinality": "multiple",
  "hierarchyTags": "selected_member_only",
  "writeReadRelationship": "require_read",
  "mixedSelection": "filter_reads_reject_writes",
  "administratorTreatment": "bypass",
  "factSideAuthority": "derived_query_aid_only"
}

Verify the outcome with the test reader's own session. A bounded scan returns the PointA value, filters out PointB, and leaves the test reader without write authority. Use the read-only inspection prompt to review the grant and policy separately.

Tools used include read_v2_program, set_v2_application_access and execute_v2_metadata_program for disposable tag setup. See the module guidelines and tool index.