{"token_count": 538}

# Application Resources

A role of version `v9` denies every HTTP request to an application it grants, unless a rule under `spec.allow.app_resources` authorizes the request. Earlier role versions authorize an application as a whole, so a user who reaches the application can send any request to it. Role v9 does not affect TCP, MCP, cloud (AWS console, Azure, and GCP), LLM, or Identity Center applications.

## Rules

In Teleport 19 the only supported rule is `allow_all: true`, which authorizes every request to the applications the role grants. It must be the only rule in the list, and `app_resources` is valid only under `allow`.

```
kind: role
version: v9
metadata:
  name: gitlab-dev
spec:
  allow:
    app_labels:
      vendor: [gitlab]
    app_resources:
      - allow_all: true

```

Teleport 19 rejects a role that sets any of the following `app_resources` fields. The role schema still declares them so that version skew or a rollback cannot silently drop one and widen the access a role grants.

- `paths`
- `methods`
- `where`
- `allow_encoded`
- `allow_code`
- `allow_reason`
- `deny_code_hint`
- `deny_reason_hint`

Teleport 19 rejects `spec.allow.app_resources_expressions` on the same grounds. It expresses the same rules as predicates.

When a v9 role and a v8 or older role both grant the same application, Teleport drops the older roles from the decision, so they cannot restore unrestricted access to an application a v9 role restricts.

## Agent version requirements

Upgrade all Application Service agents to Teleport 19 before using role v9. An agent on Teleport 18 or earlier cannot evaluate `app_resources`, so the Auth Service serves it a downgraded v8 copy of each v9 role. For a role with an `allow_all` rule the copy grants the same access as v9. For any other role the copy moves the allow `app_labels` and `app_labels_expression` to the deny side, so the older agent denies those applications instead of granting them. A role does not record which application types it grants, so a downgraded role also denies the TCP, MCP, and cloud applications it selects, and can deny more applications than the v9 role restricts.