1. Create a constant in the Trust Framework.
    1. Go to Trust Framework and then Attributes.
    2. From the + menu, select Add new Attribute.
    3. For the name, replace Untitled with allowlistAttributes.
    4. Verify that in the Parent field, no parent is selected. To remove a parent, click the delete icon to the right of the Parent field.
    5. Click + Add Resolver and set the Resolver type to Constant.
    6. Set the value of the constant to a set of square brackets that contains a comma-delimited list of the attributes that can be modified.

      For example, to allow the email or userName attributes to be modified, you would set the value of the constant to [email, userName].

      As another example, to allow the user to modify a property or any of its subproperties, you must explicitly list them. So to allow modification of the name field on the default Users pass-through schema, set the value of the constant to [name, name.formatted, name.givenName, name.familyName].

    7. In the Value Settings section, set Type to Collection.
    8. Click Save changes.
  2. Modify or create a policy to use that constant collection.
    1. Go to Policies.
    2. Select a policy or create a new one.
    3. In the Rules section:
      1. Set the Combining Algorithm to Unless one decision is permit, the decision will be deny.
      2. Click + Add Rule.
      3. For the name, replace Untitled with Allow only the email and userName attributes.
      4. Set the Effect to Permit.
      5. Under Condition, click + Comparison.
      6. In the comparison, we want to compare the constant collection of permitted attributes to the impactedAttributes collection.

        • For the left field, select the allowlistAttributes attribute, which is the constant collection of permitted attributes defined in the beginning.

          You might see the field as shown below. Click the R immediately above + Comparison to toggle to attribute selection.

          Screen capture that shows the Condition section with the R toggle
        • Set the middle field (the operator) to Contains.
        • Set the right field to the impactedAttributes attribute.

          If that field has a C before it, click the C to toggle to attribute selection.

          Note:

          If impactedAttributes is not available, see Restricting the modification of attributes.

        When applied to two collections, the Contains operator returns true if and only if the right-side collection is a subset of the left-side collection. Thus, the rule only returns permit if the set of impactedAttributes is a subset of the list of allowed attributes in allowlistAttributes.