coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add an offline attribute-admission branch beside exact-record review.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 59s
Details

Browse source 
Compact-sitting v8 can admit a new memo from carried class, submitter, and approval attributes, but shipped sets are empty and exact-record decisions stay on their pins. The sitting image pin is unchanged.

Assistant: grok
Assistant-Session: 01a10329-31cb-78d3-b7a3-788c2f91d6d4
This commit is contained in:
tegwick 2026-10-03 22:03:46 +02:00
parent d014453a1a
commit e85f511c4f
8 changed files with 1237 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

140
examples/informed-decision-sitting/attribute_fixtures.json Normal file
View file

@ -0,0 +1,140 @@
[
{
"id": "attribute-non-human-refused",
"request": {
"id": "attribute-non-human",
"tenant": "tenant:platform",
"subject": {
"id": "not-a-person",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"principal_type_source": "authentication-derived",
"tenant_source": "registration-supplied",
"groups": ["net-kingdom-admins"],
"assurance": {
"level": "aal2",
"mfa": true,
"source": "key-cape",
"methods": ["pwd", "otp"],
"at": 1
}
}
},
"action": "accept",
"resource": {
"id": "memo:intake-new-memo",
"type": "decision-memo",
"system": "informed-decision",
"tenant": "tenant:platform"
},
"context": {
"review_group": "net-kingdom-admins",
"memo_class": "credential-lane",
"intake_submitter": "state-hub",
"approval_requester": "informed-decision",
"approval_human_control": true,
"memo_version": 1,
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
},
"policy_version": "v8"
},
"expect": {
"effect": "deny",
"reason": "identity_refused"
}
},
{
"id": "attribute-stale-mfa",
"request": {
"id": "attribute-stale-mfa",
"tenant": "tenant:platform",
"subject": {
"id": "test-human",
"type": "human",
"tenant": "tenant:platform",
"attributes": {
"principal_type_source": "authentication-derived",
"tenant_source": "registration-supplied",
"groups": ["net-kingdom-admins"],
"assurance": {
"level": "aal2",
"mfa": true,
"source": "key-cape",
"methods": ["pwd", "otp"],
"at": 1
}
}
},
"action": "accept",
"resource": {
"id": "memo:intake-new-memo",
"type": "decision-memo",
"system": "informed-decision",
"tenant": "tenant:platform"
},
"context": {
"review_group": "net-kingdom-admins",
"memo_class": "credential-lane",
"intake_submitter": "state-hub",
"approval_requester": "informed-decision",
"approval_human_control": true,
"memo_version": 1,
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
},
"policy_version": "v8"
},
"expect": {
"effect": "deny",
"reason": "stale_mfa"
}
},
{
"id": "attribute-future-mfa",
"request": {
"id": "attribute-future-mfa",
"tenant": "tenant:platform",
"subject": {
"id": "test-human",
"type": "human",
"tenant": "tenant:platform",
"attributes": {
"principal_type_source": "authentication-derived",
"tenant_source": "registration-supplied",
"groups": ["net-kingdom-admins"],
"assurance": {
"level": "aal2",
"mfa": true,
"source": "key-cape",
"methods": ["pwd", "otp"],
"at": 9999999999
}
}
},
"action": "read",
"resource": {
"id": "memo:intake-new-memo",
"type": "decision-memo",
"system": "informed-decision",
"tenant": "tenant:platform"
},
"context": {
"review_group": "net-kingdom-admins",
"memo_class": "credential-lane",
"intake_submitter": "state-hub",
"approval_requester": "informed-decision",
"approval_human_control": true,
"memo_version": 1,
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4"
},
"policy_version": "v8"
},
"expect": {
"effect": "deny",
"reason": "identity_refused"
}
}
]