Access control in a decentralized control plane of a computing system

A computer system, comprising:

• a hardware platform having a processor and memory;
• a software platform executing on the hardware platform;
• a service host process executing within the software platform, the service host process including a framework that controls access to a target resource of a plurality of resources, the service host process configured to:
• receive a request for the target resource by a client, the request including a user indicator;
• identify a user group in which the user indicator is a member;
• identify a role that includes an access policy, applicable to the user group, for accessing a group of the plurality of resources, the group of resources defined by a query executable against an index of states of the plurality of resources;
• obtain a state of the target resource in response to the request;
• and
• apply the access policy of the role to the request for the target resource based on a determination of whether the state of the target resource satisfies a query filter corresponding to the query of the role.

A non-transitory computer readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method of controlling access to a target resource of a plurality of resources managed by a control plane executing on a computing system, the method comprising:

• receiving, at the control plane, a request for the target resource by a client, the request including a user indicator;
• identifying a user group in which the user indicator is a member;
• identifying a role that includes an access policy, applicable to the user group, for accessing a group of the plurality of resources, the group of resources defined by a query executable against an index of states of the plurality of resources;
• obtaining a state of the target resource in response to the request;
• and
• applying the access policy of the role to the request for the target resource based on a determination of whether the state of the target resource satisfies a query filter corresponding to the query of the role.