coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
access-engine/examples/railiance-platform/README.md

19 lines
1.3 KiB
Markdown
Raw Normal View History

feat(policy): add credential grant authorization package Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
2026-08-23 13:59:03 +02:00
# Railiance Platform credential-grant example
This package provides the flex-auth side of `FLEX-WP-0012`: registered grant
metadata, representative requester subjects, a default-deny `issue` policy,
Cover wrong-tenant denials in ops-warden and railiance-platform fixtures. FLEX-WP-0022-T03: the rules already refused a foreign tenant; the fixture suites never varied the field. No policy or version change. Asked tenant-engine to name the CheckRequest tenant relation for T01/T02. Assistant: grok Assistant-Session: 01a0a6cb-0334-72c0-83b0-2df57474a0f6
2026-09-15 23:38:48 +02:00
and fixtures for TTL, actor type, purpose, delivery mode, unknown grants, and
wrong tenant.
feat(policy): add credential grant authorization package Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
2026-08-23 13:59:03 +02:00
The wire translation is intentionally outside the policy. Both candidate
integration shapes must emit `requested_ttl_seconds` as a positive number;
duration strings such as `15m` are rejected rather than guessed.
```bash
FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020) - cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine - cmd/flex-auth: prints the rename and exits 2, with a test - image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside; live pins pass only args, so their next roll is unaffected - Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans, decisions and ADRs left as written - runtime names (module, audience, k8s, image package, /opt paths) unchanged Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 735967@bnt-lap001 Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
2026-10-10 13:26:19 +02:00
go run ./cmd/access-engine load-registry --file examples/railiance-platform/registry_snapshot.json
go run ./cmd/access-engine test-policy --file examples/railiance-platform/policy_package.md
go run ./cmd/access-engine check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_allow.json
go run ./cmd/access-engine check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_unknown.json
go run ./cmd/access-engine check --registry examples/railiance-platform/registry_snapshot.json --policy examples/railiance-platform/policy_package.md --request examples/railiance-platform/check_request_deny_wrong_tenant.json
feat(policy): add credential grant authorization package Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
2026-08-23 13:59:03 +02:00
```
Reference in a new issue Copy permalink