The OpenSearch service type in OpenSearch's own terms: indices and data streams, their fields, and the cluster as a whole, with access types that map to the security plugin's action groups, row filters that become document level security and masks that become its masked fields. Lookups read the cluster through OpenSearch's own low-level REST client, from one node or the next when one cannot be reached, signing in with a password or a TLS client certificate. ...