Which OCI identity feature allows dynamic membership changes based on defined rules?

The feature that allows dynamic membership changes based on defined rules is dynamic groups. Dynamic groups enable the automatic addition or removal of members based on specified attributes or criteria, such as resource tags or specific identity characteristics. This capability provides a flexible and efficient way to manage access without the need for manual updates when conditions change.

For example, if you have a dynamic group for all resources tagged with a certain value, any new resource that receives that tag would automatically become a member of that dynamic group. This kind of automation enhances security and simplifies management in environments where resources may frequently change due to scaling or changing operational requirements.

In contrast, traditional groups require manual membership management, while policies define permissions and access controls but do not facilitate dynamic membership. Users represent individual identities, and while they can belong to groups, they do not incorporate dynamic membership features.