DataLens RLS resolve

Overview

For cloud DataLens on Yandex Cloud (datalens.ru). RLSv2 (the rls2 field) stores subjects by id, whereas the legacy RLS (the rls text config) let you use names. This skill resolves names → ids via the yc CLI (Cloud Organization Manager) and can emit a complete rls2 config.

Users → cloud subject id (subject_claims.sub); groups → org group id. subject_name is display-only; subject_id is what enforcement uses. Unresolved subjects in convert output become notfound with a !FAILED_ name prefix. In resolve output, resolved subject objects stay under resolved and unresolved input names are listed separately under unresolved.