This feature allows the allow_list in the scopes to specify the type of a resource as well. So this is now possible:

allowList = [
  // Only access to this specific workspace
  {"type":"workspace", "id":"<uuid>"},
  // But all templates
  {"type":"template", "id":"*"},
]

This was added in support of custom scopes, primarily for AI agents. There is a need to add a scope that restricts an API key to accessing a specific workspace. With this, we can exhaustively enumerate the other resources required for functionality.

Example:

allowList = [
  // Only access to this specific workspace
  {"type":"workspace", "id":"<uuid>"},
  // Leave the rest of the permissions
  {"type":"template", "id":"*"},
  {"type":"user", "id":"*"},
  {"type":"organization", "id":"*"}, 
  {"type":"group", "id":"*"},
  // ... etc 
]

This is unfortunate that the list has to be exhaustive.