AllowedAdditions

Defines which types of additions are allowed when this entry is referenced by other entries via references.

Semantics:

• Field absent (omitted) — no restriction; the referencing entry's own subjects, resources, and namespaces are merged in as usual. This is the upgrade-friendly default.
• Field present and empty ([]) — no additions allowed; only the referenced entry's content is effective.
• Field present with values — only the listed kinds of additions survive on the referencing entry.

This field is enforced as a runtime filter, not as a write-time policy contract: a referencing entry that declares own subjects/resources/namespaces not permitted here can still be persisted, but the disallowed own additions are silently stripped at enforcement time. The same filter applies whether the reference is local (within the same policy) or an import reference.

• subjects — allows referencing entries to add additional subjects on top of this entry
• resources — allows referencing entries to add additional resources on top of this entry
• namespaces — allows referencing entries to add additional namespace patterns on top of this entry