So if I understand correctly, some groups should be able to access specific branch names (corresponding to data domains), across different repositories?

Sorry @filip floegel, but apparently what I wrote was not accurate. We currently do not support denying writes according to branch names. We do support denying commits according to branch names. So a policy that allows commits to branches named "domain1" across two different repositories, would look like:

{
  "id": "Domain1Commits",
  "statement": [
    {
      "action": [
        "fs:CreateCommit"
      ],
      "effect": "allow",
      "resource": "arn:lakefs:fs:::repository/my-first-repo/branch/domain1"
    },
    {
      "action": [
        "fs:CreateCommit"
      ],
      "effect": "allow",
      "resource": "arn:lakefs:fs:::repository/my-second-repo/branch/domain2"
    }
  ]
}

I understand this is not a very strong segregation. You are welcome to DM me and we can discuss what kind of feature is needed in lakeFS to support your use case.

cool thank you!!! When I understand correctly I could define the branches in advance and allow the domains to make commits across repositories. Will contact you anyway but thank you so far!!!