2026-02-11: IAM Service - restrictions and restrictionAware properties

Overview

restrictions property for groups

The Group object was extended with a new restrictions property. This property limits the visibility of permission-aware entities for users based on scope permissions.

restrictionAware property for access controls

The AccessControl object was extended with a new restrictionAware property. This property determines whether an access control generates scopes with restriction suffixes when assigned to a group that has restrictions defined.

When restrictionAware is set to true, the generated scopes will include restrictions (e.g., order.order_manage--DE) based on the group's restrictions list. When false, scopes are generated without restriction suffixes regardless of the group's restrictions.

Updated endpoints

Groups

Endpoint	Description
Creating a new group	Property restrictions has been introduced.
Upserting a group	Property restrictions has been introduced.
Retrieving all groups	Property restrictions has been introduced.
Retrieving a group	Property restrictions has been introduced.

Access Controls

Endpoint	Description
Retrieving all access controls	Property restrictionAware has been introduced.
Retrieving an access control	Property restrictionAware has been introduced.
Retrieving all access controls assigned to a group	Property restrictionAware has been introduced.
Retrieving all access controls assigned to a user	Property restrictionAware has been introduced.
Retrieving user access controls for a resource	Property restrictionAware has been introduced.
Retrieving all access controls assigned to the current user	Property restrictionAware has been introduced.
Retrieving all access control templates	Property restrictionAware has been introduced in expanded access controls.

Known problems

There are no known problems.