Enforces GrantForge policies in OpenSearch with the security plugin's own access control: a service beside the cluster that keeps one role per user, mapped to that user only, holding exactly what the service's signed policies give the user, with field level security, masked fields and document level security, in step with the policies, the users and the indices, and undoes changes made to those roles by hand. Index patterns of policies stay patterns wherever every ...