plugin-authz

To enforce authorization on FastAPI routes for NeMo Platform plugins, map route handlers to specific caller kinds and permission sets using declarative decorators like path_rule and AuthzScope. This ensures OPA bundle compliance and prevents unruled route exposure.

OPA bundle compliance for plugin security requires defining namespace-fenced permission sets that integrate with the platform's security catalog. It validates plugin security posture by ensuring only authorized callers execute sensitive operations through registered route rules.

To configure path rules and OAuth scopes for protected endpoints, apply the path_rule decorator directly to route handlers and define granular permission sets for caller kinds like PRINCIPAL or SERVICE_PRINCIPAL. This registers endpoints correctly in the platform security catalog.

Yes, this authorization approach prevents unauthorized access to sensitive API operations by enforcing namespace-fenced permission definitions and validating that only roles like PRINCIPAL or SERVICE_PRINCIPAL can execute status updates or data modifications.

An unruled route exposure validation error occurs when a NeMo plugin route lacks a defined path_rule and permission set mapping. Prevent this by decorating all route handlers with AuthzScope to ensure OPA bundle compliance and avoid unauthorized access.