Access Control
Status: Ineffective contract: the installed NexoFilter CRD fields do not match the runtime filter configuration, so current CRD acceptance is not reliable access enforcement.
:::caution No supported deployment contract
This capability is documented for catalog completeness, but the selected release does not publish a supported end-to-end deployment contract.
:::
Always confirm availability in the release bundle selected for deployment.
At a glance
| Property | Value |
|---|---|
| Pipeline phase | Request |
| Category | Security |
| Canonical minimum tier | Free |
| Canonical entitlement | Yes |
| Supported deployment contract | No |
| Release status | Ineffective contract: the installed NexoFilter CRD fields do not match the runtime filter configuration, so current CRD acceptance is not reliable access enforcement. |
Release accuracy
- Current documentation: Ineffective contract: the installed NexoFilter CRD fields do not match the runtime filter configuration, so current CRD acceptance is not reliable access enforcement.
Where any detail below conflicts with the release status above, the release status is authoritative. Field names and examples describe the current dashboard and CRD surface; always confirm behavior against the selected release bundle before relying on it operationally.
Release-aware feature flow. The diagram is explanatory; the release status on this page is authoritative.
Diagram resources: Open the SVG full screen · Download the editable Excalidraw source
Performance impact
:::warning Unverified performance figures
These figures are illustrative only. They are not current benchmarks or service guarantees and have not been verified by the current test suite.
:::
| Percentile | Reported figure |
|---|---|
| P50 | 0.03ms |
| P95 | 0.08ms |
| P99 | 0.15ms |
Note: Linear scan over rules (typically <10 rules). Effectively O(1) for most deployments.
Overview
The runtime contains a filter step, but the installed NexoFilter CRD publishes mode, collection, operation, and pattern fields while the runtime expects default_action, collections, commands, and other fields. The current Operator does not translate between these contracts.
A successful apply or Ready status is therefore not evidence that an operation will be denied.
When to use
- Understanding the intended future policy surface
- Evaluating the known CRD/runtime mismatch before planning access controls
How it works
- The Operator accepts the NexoFilter schema.
- The CRD serializes a field shape that differs from the runtime filter configuration.
- No supported translation aligns those fields.
- The release therefore provides no dependable proxy access-control enforcement through this CRD.
Configuration
“Not specified” means required semantics were not declared for that field.
| Field | Type | Default | Required | Description |
|---|
Settings reference
No additional settings reference is documented for this component.
Examples
No example is documented for this component.
Best practices
- Use MongoDB-native authorization for current production enforcement
- Do not treat schema admission, Ready status, or graph inclusion as proof of a denied operation
- Require an end-to-end negative test before a future release is used as an authorization boundary
Limitations
- The installed CRD/runtime configuration mismatch makes current enforcement unreliable
- No deployable access-control example is published for the current release
Security and operational guidance
- Do not use the current NexoFilter CRD as an authorization boundary
- Enforce permissions with MongoDB-native roles and independently verified controls
- Wait for a tested CRD-to-runtime contract before deploying proxy access policy
Related steps
Release availability
- Current documentation: Ineffective contract: the installed NexoFilter CRD fields do not match the runtime filter configuration, so current CRD acceptance is not reliable access enforcement.
See the component catalog for the complete comparison matrix.