A proposal here is to introduce a new API (new resource) for new approvable RBACs, then maintain both options for some time (allowing admins to opt out of the former via policy.json), then dropping the old API after some time (leaving the old api definition in api-ref for out of tree plugins to implement).
A proposal to introduce a new config option is not ideal because it introduces another point of api incompatibility between clouds.
A proposal here is to introduce a new API (new resource) for new approvable RBACs, then maintain both options for some time (allowing admins to opt out of the former via policy.json), then dropping the old API after some time (leaving the old api definition in api-ref for out of tree plugins to implement).
A proposal to introduce a new config option is not ideal because it introduces another point of api incompatibility between clouds.