Apply RBAC to Action Input Data

I use St2 to orchestrate app release workflows. I want a way to apply RBAC to action input data to restrict environment targeting. For instance, role A has an input restriction of env=dev and role B has an input restriction of env=prod, etc. This way, the users can trigger releases to environments that they own.

In my situation, I have a multitude of app environment instances so wrappering release workflows with an action to apply special RBAC on will not scale.

I am contemplating a PR to add input restrictions to the role definition, just like permission grants (and update the code to similarly validate). Input restrictions would be an optional component of a role definition. I am opening this issue to generate dialog and gauge interest in a possible change to St2.

The issue names no files, tests, or entry points. Start by locating the role-definition and RBAC validation areas, then clarify how input restrictions should be represented and enforced. Done should include an agreed design and validation of environment-specific action inputs, but the issue does not define acceptance tests.