> For the complete documentation index, see [llms.txt](https://docs.balkan.id/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.balkan.id/lifecycle-management/jitpbac/constraints.md).

# Constraints

### **Overview of Constraints**

In Just-in-Time Purpose-Based Access Control (JITPBAC), a **Constraint** specifies explicit rules or conditions that restrict access for identities within cloud and SaaS environments. A Constraint functions as the opposite of a **Purpose**. While a Purpose represents a defined set of employees and entities (such as connections and resources) that indicates which users are permitted to access or request access to those entities, a Constraint similarly involves a set of employees and entities, but explicitly prohibits access to the specified entities. In essence, a Constraint establishes a security policy that enforces denial of access, ensuring robust access control and data protection.

### Constraint Lifecycle

1. **Creation:** A Constraint is established by specifying the connections, resources, and employees for whom access should be denied for the specified entities.
2. **Usage:** Constraints are enforced whenever a user (included in the Constraint) attempts to request access to a Purpose that contains any restricted entities. The Constraint prevents those users from requesting or gaining access to any of the defined entities, even if only one of them is present within the Purpose being requested.
3. **Updates:** Administrators can modify Constraint parameters at any time to address evolving security risks or changing organizational requirements.

**Relevant Links:**

* [Create constraint](/lifecycle-management/jitpbac/constraints/create-constraint.md)
* [Edit constraint](/lifecycle-management/jitpbac/constraints/edit-constraint.md)
* [Delete constraint](/lifecycle-management/jitpbac/constraints/delete-constraint.md)
* [Filtering constraints](/lifecycle-management/jitpbac/constraints/filtering-constraints.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.balkan.id/lifecycle-management/jitpbac/constraints.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.