When Gateway is deployed by a managed service provider, cluster administrators inevitably need to cut off some or all access to the hosted domains within their cluster. This could be due to non-payment or if a customer uses too much storage and is required to clean-up space before writing new content.
All access to a domain can be controlled from the root Policy configuration file and from the domain's policy attribute. Updating the policy attribute is often desirable because, unlike an update to the root Policy file, it does not require a Gateway server restart. These examples will use the policy attribute of a domain for controlling access. Recall that the statements in an access Policy have an optional Sid field that can be used in whatever way an application wants. When injecting statements into an existing Policy, administrators can use the Sid field to keep track of the statements they added and to identify them for future removal.
...
In this example, a domain that had allowed access to the domain administrator (one of the end-users) now completely cuts off access to all end-users by adding the deny statements. The new statements use the Sid field to identify them for easy removal in the future. Notice that the statement denies authenticated users as well as anonymous users.
...
In this example, a domain is changed to read-only mode in order to prevent writing, updating, or deleting content by the-end users. The new policy statement makes use of the Sid field to identify it for future removal. This example also makes use of NotAction to specify that the deny pertains to any action not listed thus allowing the ones that are listed.
...
A cluster administrator could set the access control policy on a domain for read and delete only if a tenant exceeds their quota. By letting the end-users continue to read and delete their content, they can use the content they have already written and clean-up content in order to reduce their storage usage. As with the previous example, NotAction is used to specify that the deny pertains to any action not listed.
...