coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP: Claude Code rate-limit checkpoint (20dd5562)

Browse source
This commit is contained in:
Claude Code 2026-08-18 15:25:17 +02:00
parent 3de72fe6f5
commit 150b1f55fb
8 changed files with 230 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

42
examples/tenant-engine/policy_package.md
View file

@ -6,9 +6,12 @@ version: v1
status: ready
package: flexauth.tenant_engine.write_api
actions:
- tenant.read
- tenant.create
- tenant.role.grant
- tenant.role.revoke
- tenant.role.read
- tenant.role.read.live
- tenant.plan.assign
- tenant.update
- tenant.retire
@ -165,9 +168,12 @@ import future.keywords.if
import future.keywords.in
valid_actions := {
"tenant.read",
"tenant.create",
"tenant.role.grant",
"tenant.role.revoke",
"tenant.role.read",
"tenant.role.read.live",
"tenant.plan.assign",
"tenant.update",
"tenant.retire",
@ -176,15 +182,25 @@ valid_actions := {
"tenant.guardrail.set",
}
read_actions := {"tenant.guardrail.read"}
tenant_read_actions := {"tenant.read", "tenant.role.read"}
live_read_actions := {"tenant.role.read.live"}
guardrail_read_actions := {"tenant.guardrail.read"}
read_actions := tenant_read_actions | live_read_actions | guardrail_read_actions
mutate_actions := valid_actions - read_actions
known_subjects := {"tenant-engine", "flex-auth"}
known_subjects := {"tenant-engine", "user-engine", "flex-auth"}
read_subjects := {"tenant-engine", "flex-auth"}
tenant_read_subjects := {"tenant-engine", "user-engine"}
mutate_subjects := {"tenant-engine"}
live_read_subjects := {"flex-auth"}
guardrail_read_subjects := {"tenant-engine", "flex-auth"}
mutate_subjects := {"tenant-engine", "user-engine"}
decision := {"effect": "allow", "reason": "write_api_policy_matched"} if {
allowed
@ -194,9 +210,23 @@ decision := {"effect": "allow", "reason": "write_api_policy_matched"} if {
allowed if {
input.resource.system == "tenant-engine"
input.action in read_actions
input.action in tenant_read_actions
input.subject.type == "service"
input.subject.id in read_subjects
input.subject.id in tenant_read_subjects
}
allowed if {
input.resource.system == "tenant-engine"
input.action in live_read_actions
input.subject.type == "service"
input.subject.id in live_read_subjects
}
allowed if {
input.resource.system == "tenant-engine"
input.action in guardrail_read_actions
input.subject.type == "service"
input.subject.id in guardrail_read_subjects
}
allowed if {