2026-08-09 02:21:29 +02:00
|
|
|
# user-engine policy service
|
|
|
|
|
|
|
|
|
|
Dynamic human subjects arrive as verified KeyCape claims, so the registry
|
|
|
|
|
defines the protected system while the policy evaluates tenant, roles, and
|
|
|
|
|
self context from each request. Platform operators may cross tenants;
|
|
|
|
|
tenant administrators and self-service users may not.
|
|
|
|
|
|
|
|
|
|
Validate with:
|
|
|
|
|
|
|
|
|
|
```bash
|
FLEX-WP-0036: binary renamed to access-engine; flex-auth is a stub naming the rename (FLEX-DEC-2026-020)
- cmd/flex-auth -> cmd/access-engine; usage and serving lines say access-engine
- cmd/flex-auth: prints the rename and exits 2, with a test
- image: entrypoint /usr/local/bin/access-engine, flex-auth stub alongside;
live pins pass only args, so their next roll is unaffected
- Makefile, CI, verify-posture, tenancy.yaml, live docs updated; workplans,
decisions and ADRs left as written
- runtime names (module, audience, k8s, image package, /opt paths) unchanged
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 735967@bnt-lap001
Assistant-Session: 5971967f-77f8-4ced-9e02-c6ef67040ffc
2026-10-10 13:26:19 +02:00
|
|
|
access-engine test-policy -file examples/user-engine/policy_package.md
|
|
|
|
|
access-engine load-registry -file examples/user-engine/registry_snapshot.json
|
2026-08-09 02:21:29 +02:00
|
|
|
```
|
2026-08-16 01:16:23 +02:00
|
|
|
|
|
|
|
|
## Live production (FLEX-WP-0009-T04, 2026-08-16)
|
|
|
|
|
|
|
|
|
|
Service: `flex-auth-user-engine.flex-auth.svc.cluster.local:8080`
|
|
|
|
|
Image: `forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`
|
|
|
|
|
|
|
|
|
|
`test-policy` reports 9/9 Rego tests and 9/9 fixtures. The same nine
|
|
|
|
|
fixtures were replayed against the deployed `/v1/check` and all matched:
|
|
|
|
|
|
|
|
|
|
| Fixture | Effect / reason | Decision id |
|
|
|
|
|
| --- | --- | --- |
|
|
|
|
|
| `self-allow` | allow / `self_service` | `decision:27cbab2e5533508a` |
|
|
|
|
|
| `tenant-admin-allow` | allow / `tenant_admin` | `decision:350b46fb42989606` |
|
|
|
|
|
| `platform-allow` | allow / `platform_operator` | `decision:79334537419466bd` |
|
|
|
|
|
| `cross-tenant-deny` | deny / `cross_tenant` | `decision:b3cc0b7e819aecde` |
|
|
|
|
|
| `missing-role-deny` | deny / `no_matching_role_or_context` | `decision:818e2249491ef09f` |
|
|
|
|
|
| `wrong-system-deny` | deny / `wrong_system` | `decision:5e20697e202aa7c6` |
|
|
|
|
|
| `registration-applicant-allow` | allow / `registration_applicant` | `decision:d83fc413afebf2f6` |
|
|
|
|
|
| `registration-applicant-membership-deny` | deny / `no_matching_role_or_context` | `decision:4ca487126987f89c` |
|
|
|
|
|
| `registration-applicant-wrong-issuer-deny` | deny / `no_matching_role_or_context` | `decision:138c574dee279d23` |
|
|
|
|
|
|
|
|
|
|
From the user-engine namespace the Service `/healthz` is HTTP 200.
|
|
|
|
|
Unavailability is connection-refused / NXDOMAIN; the consumer adapter
|
|
|
|
|
denies with `authorization service unavailable`.
|
