Preview features
Identity and access features you can configure through the API today but that do not yet change, or only partly change, who can do what.
What Preview means
A feature is in Preview when its API is public and works, but the feature is not finished. For a Preview feature:
- The API accepts, validates, stores and returns your configuration. Each page lists the permission each call needs.
- The configuration may not affect access yet. Each Preview page starts by saying, in plain words, what does not take effect, and then documents what does.
- The API may change. Paths, request and response fields, permission names and behavior can change before the feature leaves Preview, without a deprecation period.
Do not use a Preview feature as your only control for something that must be enforced. Use the features in the guides instead: policies, groups, roles and service users.
Two ways a request is checked
To read the "Takes effect today?" column, you need to know that Hexel Studio has two decision paths.
The cached permission check decides your normal API calls. It looks only at the Allow statements of the policies that apply to the caller: policies attached to the member or service user, to its groups, and through permission sets. For a role session it uses the role's policies, capped by the role's permission boundary. It ignores everything else on the Preview list, including Deny statements.
The full evaluator runs more steps: service control policies, resource control policies, permission boundaries on members and service users, session policies, Deny statements and ABAC rules. It is used by:
POST /v1/authz/evaluate,POST /v1/authz/simulateandPOST /v1/authz/explain(see Test access).- The check Hexel Studio makes on the caller's own organization when a member or service user assumes a role in another organization (see Roles).
Preview features
| Feature | Page | Takes effect today? |
|---|---|---|
Permission boundary set as a role's boundary_id | Guardrails | Yes. It caps every call made with that role's sessions. |
| Permission boundaries on members and service users | Guardrails | No. Only in the full evaluator. |
Permission boundaries on groups and roles (target_type GROUP or ROLE) | Guardrails | No. They cap nothing, in either path. |
| Service control policies (SCPs) | Guardrails | No. Only in the full evaluator. |
| Resource control policies (RCPs) | Guardrails | No. Only in the full evaluator, and only when the request names a resource type. |
| Deny statements in policies | Guardrails | No. Only in the full evaluator. |
Workload identity providers and Federated trust principals | Workload identity | No. A workload cannot exchange its token for a Hexel Studio token yet. Trust simulation works. |
| Just-in-time access requests | Just-in-time access | No. An approved or active request grants nothing. |
| Approval workflows and requests | Just-in-time access | No. An approved request changes nothing. |
| Access reviews | Access reviews | No. A REVOKE decision removes no access. Schedules never run. |
Organization-wide audit logs (GET /v1/organizations/{organization_id}/audit-logs, GET /v1/audit/logs) | Audit logs | No. No new events are written to them; group history works. |
Resource and Condition in policy statements | Fine-grained access | No. Stored and ignored in both paths. |
| Resource policies | Fine-grained access | No. Stored only. |
| Relationship tuples and namespaces | Fine-grained access | No. The relation check endpoint answers, but no access decision reads tuples. |
| ABAC attributes and policies | Fine-grained access | No. Only in the full evaluator. |
| Tags | Fine-grained access | No. Stored only. |
| Session policies | Session policies | No. Only in the full evaluator. |
| SIEM export | SIEM export | No. Nothing is sent to your SIEM. |
| Audit reports, scans, findings and retention policies | SIEM export | No. Stored only. Scans never run and retention is not applied. |
Who can use Preview APIs
Preview APIs use the same permissions model as the rest of the API. Each page lists the action each endpoint needs, and notes any endpoint that checks no specific action. Organization owners hold every action. To give someone access to a Preview API, attach a policy that allows its actions, as described in Write policies.